USN-6916-1: Lua vulnerabilities
29 July 2024
Several security issues were fixed in Lua.
Releases
Packages
- lua5.4 - Simple, extensible, embeddable programming language
Details
It was discovered that Lua did not properly generate code when "_ENV" is
constant. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary unstrusted lua code. (CVE-2022-28805)
It was discovered that Lua did not properly handle C stack overflows during
error handling. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-33099)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
-
lua5.4
-
5.4.4-1ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.