CVE-2014-5461

Name	CVE-2014-5461
Description	Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-47-1, DSA-3015-1, DSA-3016-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lua5.1 (PTS)	bookworm	5.1.5-9	fixed
	trixie	5.1.5-11	fixed
	forky, sid	5.1.5-12	fixed
lua5.2 (PTS)	bookworm, trixie	5.2.4-3	fixed
	forky, sid	5.2.4-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
lua5.1	source	squeeze	5.1.4-5+deb6u1	DLA-47-1
lua5.1	source	wheezy	5.1.5-4+deb7u1	DSA-3015-1
lua5.1	source	(unstable)	5.1.5-7
lua5.2	source	wheezy	5.2.1-3+deb7u1	DSA-3016-1
lua5.2	source	(unstable)	5.2.3-1

http://www.lua.org/bugs.html#5.2.2-1
fixed in 5.2.3, see https://bugzilla.redhat.com/show_bug.cgi?id=1132304#c7