USN-6916-1: Lua vulnerabilities

Releases

• Ubuntu 22.04 LTS

Packages

• lua5.4 - Simple, extensible, embeddable programming language

Details

It was discovered that Lua did not properly generate code when "_ENV" is
constant. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary unstrusted lua code. (CVE-2022-28805)

It was discovered that Lua did not properly handle C stack overflows during
error handling. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-33099)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• lua5.4 - 5.4.4-1ubuntu0.1~esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-33099
• CVE-2022-28805