NVD Vulnerability Detail

CVE-2019-6706

Summary	Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
Publication Date	Jan. 24, 2019, 4:29 a.m.
Registration Date	Jan. 26, 2021, 11:44 a.m.
Last Update	Nov. 21, 2024, 1:46 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:lua:lua:5.3.5:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lua-users.org/lists/lua-l/2019-01/msg00039.html	Broken Link
2	http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.html	Exploit Third Party Advisory VDB Entry
3	https://access.redhat.com/security/cve/cve-2019-6706	Third Party Advisory
4	https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71e	Patch Third Party Advisory
5	https://github.com/Lua-Project/cve-analysis/blob/a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdf	Exploit Third Party Advisory
6	https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html
7	http://lua-users.org/lists/lua-l/2019-01/msg00039.html	Broken Link
8	https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html
9	https://github.com/Lua-Project/cve-analysis/blob/a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdf	Exploit Third Party Advisory
10	https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71e	Patch Third Party Advisory
11	https://access.redhat.com/security/cve/cve-2019-6706	Third Party Advisory
12	http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.html	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-416	解放済みメモリの使用	https://cwe.mitre.org/data/definitions/416.html

JVN Vulnerability Information

Lua における解放済みメモリの使用に関する脆弱性

Title	Lua における解放済みメモリの使用に関する脆弱性
Summary	Lua には、解放済みメモリの使用に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 10, 2019, midnight
Registration Date	March 4, 2019, 4:53 p.m.
Last Update	March 4, 2019, 4:53 p.m.

Affected System

Lua.org

Lua 5.3.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-6706	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6706
2	CVE-2019-6706	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6706
National Vulnerability Database (NVD)
3	CVE-2019-6706	https://nvd.nist.gov/vuln/detail/CVE-2019-6706
4	CVE-2019-6706	https://nvd.nist.gov/vuln/detail/CVE-2019-6706

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-416	https://cwe.mitre.org/data/definitions/416.html
2	CWE-416	https://cwe.mitre.org/data/definitions/416.html

ベンダー情報

その他

No	Name	URL
関連文書
1	Lua 5.3.5 - 'debug.upvaluejoin' Use After Free	https://www.exploit-db.com/exploits/46246
2	Lua 5.3.5 - 'debug.upvaluejoin' Use After Free	https://www.exploit-db.com/exploits/46246

Change Log

No	Changed Details	Date of change
1	[2019年03月04日] 掲載	March 4, 2019, 4:53 p.m.