Logo
›
›vulnerability›CVE-2019-6706
Name
CVE-2019-6706
Source
NVD ( link)Debian ( link)
Description
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
CWEs
CWE-416
Published Date
Updated Date
Workaround
-
Advisories
http://lua-users.org/lists/lua-l/2019-01/msg00039.htmlBroken Link
http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.htmlExploit
https://access.redhat.com/security/cve/cve-2019-6706Third Party Advisory
https://github.com/Lua-Project/cve-analysis/blob/a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdfExploit
https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71ePatch
http://lua-users.org/lists/lua-l/2019-01/msg00039.htmlBroken Link
http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.htmlExploit
https://access.redhat.com/security/cve/cve-2019-6706Third Party Advisory
https://github.com/Lua-Project/cve-analysis/blob/a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdfExploit
https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71ePatch

Analysis#

Affected Component
Analysis
lua
Patched
lua5.3
Patched
lua5.4
Patched

Vulnerability Ratings#

7.5
CVSSv31
5
CVSSv2

Others affected components#

Name
Project
Project Version
Version
Status
lua
buildroot
2025.02.x
5.1.5
Not Affected
lua
buildroot
master
5.1.5
Not Affected
lua
openwrt
openwrt-25.12
5.1.5-r11
Patched
lua5.3
openwrt
openwrt-25.12
5.3.5-r6
Patched
lua5.4
openwrt
openwrt-25.12
5.4.7-r1
Patched
lua
yocto
kirkstone
5.4.4
Not Affected
lua
yocto
master
5.5.0
Not Affected
lua
yocto
scarthgap
5.4.6
Not Affected

Resolved with patches#

lua5.3 (openwrt:master)

#
Title
Author
Resolve
1
Fixed bug in 'lua_upvaluejoin'
Roberto Ierusalimschy <roberto@inf.puc-rio.br>
CVE-2019-6706

lua5.3 (openwrt:openwrt-25.12)

#
Title
Author
Resolve
1
Fixed bug in 'lua_upvaluejoin'
Roberto Ierusalimschy <roberto@inf.puc-rio.br>
CVE-2019-6706