[Git][security-tracker-team/security-tracker][master] CVE-2021-43519: document first vulnerable commit

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a2d671e4 by Bastien Roucariès at 2023-06-25T21:06:43+00:00
CVE-2021-43519: document first vulnerable commit

Stack overflow was likely introduced by commit Oct of 12, 2020, that refactor
cororoutine and remove (line 688) stack overflow checking:
	if (getCcalls(L) >= LUAI_MAXCCALLS)

This will need more testing by using POC but likely some version are not affected

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -122910,6 +122910,7 @@ CVE-2021-43519 (Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5
 	NOTE: http://lua-users.org/lists/lua-l/2021-10/msg00123.html
 	NOTE: http://lua-users.org/lists/lua-l/2021-11/msg00015.html
 	NOTE: Fixed by: https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868 (v5.4.4)
+	NOTE: Likely introduced by https://github.com/lua/lua/commit/287b302acb8d925178e9edb800f0a8d18c7d35f6
 CVE-2021-43518 (Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow.  ...)
 	- teeworlds 0.7.5-2 (bug #1009070)
 	[bullseye] - teeworlds <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2d671e483592f0cb97ba2e4ac250b37ca9ac1fa

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2d671e483592f0cb97ba2e4ac250b37ca9ac1fa
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230625/73dffb12/attachment-0001.htm>