Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2020-24371: Debian Lua 5.4 may crash during garbage collection
CVE-2020-24371 · published 6 years ago
Summary
The Lua 5.4 interpreter packaged for Debian can encounter a memory error when it runs its automatic memory cleanup. This can cause the program to stop working unexpectedly. Updating to a newer Lua version or applying the Debian security patch will resolve the issue.
What to do
- Update debian lua5.4 to version 5.4.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | lua5.4 |
< 5.4.1-1 Fix: upgrade to 5.4.1-1
|
| Debian:13 | debian | lua5.4 |
< 5.4.1-1 Fix: upgrade to 5.4.1-1
|
| Debian:14 | debian | lua5.4 |
< 5.4.1-1 Fix: upgrade to 5.4.1-1
|
| – | lua | lua |
5.4.0 cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:* |
Original advisory text
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
References
- https://security-tracker.debian.org/tracker/CVE-2020-24371 Vendor Advisory
- https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110 Patch Third Party Advisory
- https://www.lua.org/bugs.html#5.4.0-10 Exploit Patch Release Notes Vendor Advisory
Severity
5.3
Medium
Type
CWE-763Release of Invalid Pointer or Reference
Timeline
Published17 Aug 2020
Updated3 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta