Date: Wed, 27 Aug 2014 01:20:39 -0400 (EDT) From: cve-assign@...re.org To: fweimer@...hat.com, mmcallis@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Lua CVE request [was Re: CVE request: possible overflow in vararg functions] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > http://www.lua.org/bugs.html#5.2.2-1 > Stack overflow in vararg functions with many fixed parameters called with few arguments. Use CVE-2014-5461. > Lua has some sandboxing functionality, but it can be bypassed by > supplying precompiled bytecode. There have been extensive discussions > about this on the lua-users mailing list, e.g.: > > <http://lua-users.org/lists/lua-l/2011-10/msg01215.html> We did not immediately find information to decide on the number of CVE IDs. Picking a few random frames from http://www.youtube.com/watch?v=OSMOTDLrBCQ suggested that approximately three CVE-2011-#### IDs could be assigned. If anyone has better information, or even the same information in a text format, that could be useful (if the CVE-2011-#### IDs are needed). - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJT/WotAAoJEKllVAevmvmsIakH/00bWTQa336V/umZwZBZdlf1 hRxiiKg+ra2kDTHaZTqF/bz4j6LPrsYXD2antj9V2VoI3iMgxOemdajYC9Um3QDq x9ocSRDnxoxsMhvapO+2Y0DsnaHzWwj008mTB1Sl5OuEPTnNK3V4gRlMErZU4Mi/ meJqBDfh4XemDnQ+3TtAbf6FeY/eDTOIujf118uSDYdw77r7vig217X7rbH2BFAt 9QPjWylkGyXiX2P+C6k4TbSBLfMpyzHNBE9CTtrm7FV0wsjzll7F6ylpOaeS3VwH G5TRK4lZQqoRMauiERyaCZ2rJZGQKUyV2LPbtn7F5B7pjun1Hei8rv2fKoGPej4= =DZHj -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.