Linux · Security advisory · November 14, 2019

ELSA-2019-3706: Security update for 3 packages

ELSA-2019-3706, released November 14, 2019, fixes 1 CVE across 3 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
1
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.1736
97th percentile

Fixed package versions

ProductReleaseFixed in
luaol 80:5.3.4-11.el8
lua-develol 80:5.3.4-11.el8
lua-libsol 80:5.3.4-11.el8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2019-6706 Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships. 7.5 0.1736 None reported
Showing 1 to 1 of 1 1