Ubuntu Security Notice 2338-1 - It was discovered that Lua incorrectly handled certain vararg functions with a large number of fixed parameters. An attacker could use this issue to cause Lua applications to crash, resulting in a denial of service, or possibly execute arbitrary code.
742386c70e5001c109ed1b9fd23764fe2289037eeb35b4ae341694d1484682de
============================================================================
Ubuntu Security Notice USN-2338-1
September 03, 2014
lua5.1 vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Lua could be made to crash or run programs.
Software Description:
- lua5.1: Simple, extensible, embeddable programming language
Details:
It was discovered that Lua incorrectly handled certain vararg functions
with a large number of fixed parameters. An attacker could use this issue
to cause Lua applications to crash, resulting in a denial of service, or
possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
liblua5.1-0 5.1.5-5ubuntu0.1
lua5.1 5.1.5-5ubuntu0.1
Ubuntu 12.04 LTS:
liblua5.1-0 5.1.4-12ubuntu1.1
lua5.1 5.1.4-12ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2338-1
CVE-2014-5461
Package Information:
https://launchpad.net/ubuntu/+source/lua5.1/5.1.5-5ubuntu0.1
https://launchpad.net/ubuntu/+source/lua5.1/5.1.4-12ubuntu1.1