← back
CVE-2019-6706

CVE-2019-6706

EPSS 17.2%
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.htmlunverifiedexploitdbwww.exploit-db.com/exploits/46246unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lua-users.org/lists/lua-l/2019-01/msg00039.htmlhttp://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.htmlhttps://access.redhat.com/security/cve/cve-2019-6706https://github.com/lua/lua/commit/89aee84cbc9224f638f3b7951b306d2ee8ecb71ehttps://github.com/Lua-Project/cve-analysis/blob/a43c9ccd00274b31fa2f24c6c8f20ce36655682d/CVE-2019-6706.pdfhttps://lists.debian.org/debian-lts-announce/2023/06/msg00031.html