CVE-2022-33099: Out-of-bounds Write

July 1, 2022 (updated November 9, 2023)

An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.

References

github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf
lua-users.org/lists/lua-l/2022-05/msg00035.html
lua-users.org/lists/lua-l/2022-05/msg00042.html
lua-users.org/lists/lua-l/2022-05/msg00073.html
nvd.nist.gov/vuln/detail/CVE-2022-33099
www.lua.org/bugs.html

Code Behaviors & Features

Detect and mitigate CVE-2022-33099 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →