CVE-2019-6706

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-6706

Severity

7.5

High

CVSS CVSS_V3

Description

Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.

References

https://images.chainguard.dev/security/CGA-w6jq-w873-v56h
https://github.com/advisories/GHSA-f6gj-vrmg-ccf7
http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.html
https://access.redhat.com/security/cve/cve-2019-6706
https://github.com/Lua-Project/cve-analysis/blob/a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdf
https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71e
http://lua-users.org/lists/lua-l/2019-01/msg00039.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html
https://security.alpinelinux.org/vuln/CVE-2019-6706
https://security-tracker.debian.org/tracker/CVE-2019-6706

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Private Policy

Product

Chainguard Containers Chainguard Libraries Chainguard VMs Integrations Pricing

Solutions

FedRAMP PCI DSS Golden Images CVE Remediation Public Sector

Customers

Customer Stories Chainguard Reviews

Resources

Events & Webinars Chainguard Courses Documentation Trust Center

Company

About Us Blog Partners Newsroom Careers Legal