Bug#1034847: lua5.3: CVE-2021-43519

2023-06-23 Thread Guilhem Moulin
Hi carnil, On Fri, 23 Jun 2023 at 21:49:21 +0200, Salvatore Bonaccorso wrote: > thanks for the analysis. I want to point out that it's really > important to not rely on the POC for making the not-affected > assessment (and when not confirmed, rather err on the safe side and > keep something

Bug#1034847: lua5.3: CVE-2021-43519

2023-06-23 Thread Salvatore Bonaccorso
Hi Guilhem, On Fri, Jun 23, 2023 at 12:27:32PM +0200, Guilhem Moulin wrote: > On Thu, 22 Jun 2023 at 18:08:39 +0200, Guilhem Moulin wrote: > > bullseye > > > > > > $ lua5.1 ./cstack.lua > > testing stack overflow detection > > nesting coroutines running after recoverable errors > >

Bug#1034847: lua5.3: CVE-2021-43519

2023-06-23 Thread Guilhem Moulin
On Thu, 22 Jun 2023 at 18:08:39 +0200, Guilhem Moulin wrote: > bullseye > > > $ lua5.1 ./cstack.lua > testing stack overflow detection > nesting coroutines running after recoverable errors > final count:198 > > $ lua5.2 ./cstack.lua > testing stack overflow detection >

Bug#1034847: lua5.3: CVE-2021-43519

2023-06-22 Thread Guilhem Moulin
Hi Moritz, On Tue, 25 Apr 2023 at 20:58:00 +0200, Moritz Mühlenhoff wrote: > CVE-2021-43519[0]: > | Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 > | allows attackers to perform a Denial of Service via a crafted script > | file. While trigaging this for LTS I was unable to

Bug#1034847: lua5.3: CVE-2021-43519

2023-04-25 Thread Moritz Mühlenhoff
Source: lua5.3 X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, The following vulnerability was published for lua5.3. CVE-2021-43519[0]: | Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 | allows attackers to perform a Denial of Service via a