Bugzilla – Bug 1174371
VUL-1: CVE-2020-15889: lua,lua51,lua53: getobjname heap-based buffer over-read
Last modified: 2020-10-27 16:19:52 UTC
CVE-2020-15889 Lua through 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15889 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15889 https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312 http://lua-users.org/lists/lua-l/2020-07/msg00078.html
The bug was introduced in commit f5f3df3bd17fb3489bbd26ab39fe1580a8dbf9c9 which was merged in Lua 5.4. SUSE:SLE-11:Update lua Not affected [1] SUSE:SLE-12:Update lua Not affected [1] SUSE:SLE-12:Update lua51 Not affected [1] SUSE:SLE-15:Update lua51 Not affected [1] SUSE:SLE-15:Update lua53 Not affected [1] openSUSE:Factory lua53 Not affected [1] openSUSE:Factory lua54 Affected [1] code not present
The fix from https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312 is included in the upcoming release to Factory. https://build.opensuse.org/package/view_file/openSUSE:Factory:Staging:E/lua54/upstream-bugs.patch?expand=1
Reassigned to security-team@suse.de
Reached Factory https://build.opensuse.org/request/show/821867
Done