Multiple vulnerabilities have been discovered in Lua, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/lua | * | < 5.4.4-r103:5.4, < 5.2.3:5.2, < 5.1.5-r200:5.1, <= 5.1.5-r4:0 | >= 5.4.4-r103:5.4, >= 5.2.3:5.2, >= 5.1.5-r200:5.1 |
Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description.
Multiple vulnerabilities have been discovered in Lua. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Lua 5.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/lua-5.1.5-r200"
All Lua 5.3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/lua-5.2.3"
All Lua 5.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/lua-5.4.4-r103"
A buffer overflow in Lua might allow context-dependent attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-lang/lua | * | < 5.1.5-r4 | >= 5.1.5-r4 |
Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description.
A buffer overflow was discovered in the vararg functions in ldo.c in Lua.
Context-dependent could cause a Denial of Service condition or execute arbitrary code.
There is no known workaround at this time.
All Lua users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/lua-5.1.5-r4"