CVE-2022-33099: Out-of-bounds Write

July 1, 2022 (updated November 9, 2023)

An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.

References

github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf
lua-users.org/lists/lua-l/2022-05/msg00035.html
lua-users.org/lists/lua-l/2022-05/msg00042.html
lua-users.org/lists/lua-l/2022-05/msg00073.html
nvd.nist.gov/vuln/detail/CVE-2022-33099
www.lua.org/bugs.html

Code Behaviors & Features

Detect and mitigate CVE-2022-33099 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →