[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2019-6706/lua5.3: Point to post on lua-users list.

[Guilhem Moulin (@guilhem)]

Guilhem Moulin pushed to branch master at Debian Security Tracker / security-tracker


Commits:
bae92072 by Guilhem Moulin at 2023-06-22T13:40:46+02:00
CVE-2019-6706/lua5.3: Point to post on lua-users list.

Nabble has been deprecated.

- - - - -
32dcaa6f by Guilhem Moulin at 2023-06-22T13:40:48+02:00
CVE-2021-43519/lua5.3: Add tag ref for upstream fix 74d99057.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -122470,7 +122470,7 @@ CVE-2021-43519 (Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5
 	- lua50 <not-affected> (Vulnerable code not present)
 	NOTE: http://lua-users.org/lists/lua-l/2021-10/msg00123.html
 	NOTE: http://lua-users.org/lists/lua-l/2021-11/msg00015.html
-	NOTE: Fixed by: https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868
+	NOTE: Fixed by: https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868 (v5.4.4)
 CVE-2021-43518 (Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow.  ...)
 	- teeworlds 0.7.5-2 (bug #1009070)
 	[bullseye] - teeworlds <no-dsa> (Minor issue)
@@ -305367,7 +305367,7 @@ CVE-2019-6706 (Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For
 	- lua5.2 <not-affected> (Vulnerable code introduced later)
 	- lua5.1 <not-affected> (Vulnerable code introduced later)
 	- lua50 <not-affected> (Vulnerable code introduced later)
-	NOTE: http://lua.2524044.n2.nabble.com/Bug-Report-Use-after-free-in-debug-upvaluejoin-tc7685506.html
+	NOTE: http://lua-users.org/lists/lua-l/2019-01/msg00039.html
 	NOTE: lua50 and lua5.1 don't have the affected code.
 	NOTE: lua5.2 is not vulnerable as it doesn't free the value before using it.
 	NOTE: https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71e (v5.3.6)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/73c8cf3ce3a1e90520077f052e2e3e13ecec5135...32dcaa6f6f97e62e4d50f9dabf17859f532a874a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/73c8cf3ce3a1e90520077f052e2e3e13ecec5135...32dcaa6f6f97e62e4d50f9dabf17859f532a874a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230622/c4c67433/attachment.htm>