Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.

An update of the nmap package has been released.

An update of the lua package has been released.

The remote host is affected by the vulnerability described in GLSA-202305-23 (Lua: Multiple Vulnerabilities)

  - Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-     dependent attackers to cause a denial of service (crash) via a small number of arguments to a function     with a large number of fixed arguments. (CVE-2014-5461)

  - Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which     can cause a local denial of service. (CVE-2021-44647)

  - singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain     luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles     untrusted Lua code. (CVE-2022-28805)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of lua installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-44647 advisory.

  - Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which     can cause a local denial of service. (CVE-2021-44647)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-176 advisory.

  - Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial     of Service via a crafted script file. (CVE-2021-43519)

  - Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which     can cause a local denial of service. (CVE-2021-44647)

  - singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain     luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles     untrusted Lua code. (CVE-2022-28805)

  - An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a     recursive error occurs. (CVE-2022-33099)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203884	Photon OS 3.0: Nmap PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203800	Photon OS 3.0: Lua PHSA-2023-3.0-0620	Nessus	PhotonOS Local Security Checks	medium
203667	Photon OS 4.0: Nmap PHSA-2023-4.0-0517	Nessus	PhotonOS Local Security Checks	high
203606	Photon OS 5.0: Nmap PHSA-2023-5.0-0036	Nessus	PhotonOS Local Security Checks	critical
203238	Photon OS 4.0: Lua PHSA-2022-4.0-0168	Nessus	PhotonOS Local Security Checks	medium
175055	GLSA-202305-23 : Lua: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
172919	CBL Mariner 2.0 Security Update: lua (CVE-2021-44647)	Nessus	MarinerOS Local Security Checks	medium
166997	Amazon Linux 2022 : (ALAS2022-2022-176)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2021-44647

medium

Tenable Plugins

critical

medium

high

critical

medium

critical

medium

critical