CVE-2020-15888
 
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
4
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
Lua versiones hasta 5.4.0, maneja inapropiadamente la interacción entre el cambio de tamaño de la pila y la recolección de basura, conllevando a un desbordamiento del búfer en la región heap de la memoria, a una lectura excesiva del búfer en la región heap de la memoria o un uso de la memoria previamente liberada
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-07-21 CVE Reserved
- 2020-07-21 CVE Published
- 2024-06-11 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
- CWE-416: Use After Free
- CWE-787: Out-of-bounds Write
CAPEC
References (6)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
http://lua-users.org/lists/lua-l/2020-07/msg00053.html | 2024-08-04 | |
http://lua-users.org/lists/lua-l/2020-07/msg00054.html | 2024-08-04 | |
http://lua-users.org/lists/lua-l/2020-07/msg00071.html | 2024-08-04 | |
http://lua-users.org/lists/lua-l/2020-07/msg00079.html | 2024-08-04 |
URL | Date | SRC |
---|---|---|
https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7 | 2023-05-16 | |
https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5 | 2023-05-16 |
URL | Date | SRC |
---|