In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2...
Moderate severity
Unreviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Mar 30, 2024
Description
Published by the National Vulnerability Database
Nov 29, 2019
Published to the GitHub Advisory Database
May 24, 2022
Last updated
Mar 30, 2024
In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled.
References