CVE-2014-5461
lua5.2 - security update
EPSS 11.6%
Description
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
How to fix CVE-2014-5461
To remediate CVE-2014-5461, upgrade the affected package to a fixed version below.
- Debian/lua5.1—upgrade to 5.1.5-7 or later
- Debian/lua5.1—upgrade to 5.1.4-5+deb6u1 or later
- Debian/lua5.1—upgrade to 5.1.5-4+deb7u1 or later
- —upgrade to 5.2.3-1 or later
- —upgrade to 5.2.1-3+deb7u1 or later
Is CVE-2014-5461 being exploited?
Moderate — EPSS is 11.6%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (5)
- from 0, < 5.1.5-7
- from 0, < 5.1.4-5+deb6u1
- from 0, < 5.1.5-4+deb7u1
- from 0, < 5.2.3-1
- from 0, < 5.2.1-3+deb7u1