CVE-2019-6706 describes a use-after-free vulnerability in Lua 5.3.5, specifically within the lua_upvaluejoin function in lapi.c, affecting Lua and Canonical Ubuntu Linux products. This high-severity vulnerability (CVSS 7.5) can be triggered remotely without user interaction, potentially leading to a denial of service (crash). While not listed in CISA's KEV catalog, an exploit for this flaw is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.3.5CPE matchmatch criteria | cpe:2.3:a:lua:lua:5.3.5:*:*:*:*:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | ||
18.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
lua: use-after-free in lua_upvaluejoin in lapi.c resulting in denial of service
Jan 10, 2019Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
Jan 8, 2019