CVE-2022-33099 An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lua Vulnerabilities CVE-2022-33099 and CVE-2022-28805 Published Two vulnerabilities in Lua have been published, affecting versions 5.4.4 and below. CVE-2022-33099 relates to an issue in the luaG_runerror component, while CVE-2022-28805 concerns a missing luaK_exp2anyregup call in lparser.c, leading to heap-based buffer overflows. Both vulnerabilities could potentially allow for exploitation in affected systems. 2 sources 43