oss-security - Lua 5.1.4

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Tue, 24 Mar 2009 14:37:13 -0700
From: Kees Cook <kees@...ntu.com>
To: oss-security@...ts.openwall.com
Subject: Lua 5.1.4

Has anyone looked at the Lua fixes[1] in 5.1.4?  I'm not familiar with the
codebase, but it seems that several may have security implications:

 2: stack overflow  (this is the Lua stack? so... heap overflow?)
 3: integer overflow
 4: integer overflow
 6: stack overflow  (this is the Lua stack? so... heap overflow?)
 8: memory writing?
 9: memory reading
10: CPU DoS

I haven't had a chance to examine it closely yet.  Has anyone looked at
these changes?

-Kees

[1] http://www.lua.org/bugs.html

-- 
Kees Cook
Ubuntu Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.