CVE-2014-5461
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows...
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
CVE-2014-5461- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
CVE-2014-5461- Updated
- 2026-11-02
EUVDEUVD-2014-5348 No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
EUVD-2014-5348- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3hh-4h88-w4mr No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows...
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
GHSA-v3hh-4h88-w4mr- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVAZL-41108 No score
CVE-2014-5461 affecting package ceph for versions less than 18.2.2-1
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
AZL-41108- Updated
- 2026-11-05
OSVAZL-45036 No score
CVE-2014-5461 affecting package compat-lua 5.1.5-17
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
AZL-45036- Updated
- 2026-11-05
Show 6 moreShow less
OSV No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
CVE-2014-5461- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5461 No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
DEBIAN-CVE-2014-5461- Updated
- 2026-11-02
OSVMGASA-2014-0414 No score
Updated lua and lua5.1 packages fix security vulnerability
A heap-based overflow vulnerability was found in the way Lua handles varargs functions with many fixed parameters called with few arguments, leading to application crashes or, potentially, arbitrary code execution (CVE-2014-5461).
- Record
MGASA-2014-0414- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15247-1 No score
moarvm-2025.05-1.1 on GA media
These are all security issues fixed in the moarvm-2025.05-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15247-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-5461 No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
UBUNTU-CVE-2014-5461- Updated
- 2026-11-02
OSVUSN-2338-1 No score
lua5.1 vulnerability
It was discovered that Lua incorrectly handled certain vararg functions with a large number of fixed parameters. An attacker could use this issue to cause Lua applications to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-2338-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cephAzure Linux:3 |
before 18.2.2-1 | 18.2.2-1 |
compat-luaAzure Linux:3 |
through 5.1.5-17 | None known |
lua5.1Debian:12 |
before 5.1.5-7 | 5.1.5-7 |
lua5.1Debian:13 |
before 5.1.5-7 | 5.1.5-7 |
lua5.1Debian:14 |
before 5.1.5-7 | 5.1.5-7 |
lua5.2Debian:12 |
before 5.2.3-1 | 5.2.3-1 |
lua5.2Debian:13 |
before 5.2.3-1 | 5.2.3-1 |
lua5.2Debian:14 |
before 5.2.3-1 | 5.2.3-1 |
lua5.1Debian:6.0 |
before 5.1.4-5+deb6u1, plus listed versions 5.1.4-5 |
5.1.4-5+deb6u1 |
lua5.1Debian:7 |
before 5.1.5-4+deb7u1, plus listed versions 5.1.5-4 |
5.1.5-4+deb7u1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lua5.2Debian:7 |
before 5.2.1-3+deb7u1, plus listed versions 5.2.1-3 |
5.2.1-3+deb7u1 |
lua5.1Mageia:3 |
before 5.1.5-2.2.mga3 | 5.1.5-2.2.mga3 |
luaMageia:3 |
before 5.2.2-1.1.mga3 | 5.2.2-1.1.mga3 |
lua5.1Mageia:4 |
before 5.1.5-4.1.mga4 | 5.1.5-4.1.mga4 |
luaMageia:4 |
before 5.2.2-2.1.mga4 | 5.2.2-2.1.mga4 |
lua5.1Ubuntu:14.04:LTS |
before 5.1.5-5ubuntu0.1, plus listed versions 5.1.5-5 |
5.1.5-5ubuntu0.1 |
moarvmopenSUSE:Tumbleweed |
before 2025.05-1.1 | 2025.05-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-5461 is a medium vulnerability (CVSS 5.0) in Lua, published August 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.0%, the 96th percentile. Fixed in ceph 18.2.2-1.
References
openwall.com/lists/oss-security/2014/08/21/4
ubuntu.com/usn/USN-2338-1
security.gentoo.org/glsa/201701-53
securityfocus.com/bid/69342
secunia.com/advisories/59890
Show 18 moreShow less
mandriva.com/security/advisories?name=MDVSA-2015:144
debian.org/security/2014/dsa-3016
lua.org/bugs.html
lists.opensuse.org/opensuse-updates/2014-09/msg00030.html
advisories.mageia.org/MGASA-2014-0414.html
nvd.nist.gov/vuln/detail/CVE-2014-5461
github.com/advisories/GHSA-v3hh-4h88-w4mr
security-tracker.debian.org/tracker/CVE-2014-5461
bugs.mageia.org/show_bug.cgi?id=14038
ubuntu.com/security/CVE-2014-5461
cve.org/CVERecord?id=CVE-2014-5461
suse.com/security/cve/CVE-2014-5461