{"id":"CVE-2020-24370","aliases":["ALSA-2021:4510","AZL-41149","BELL-CVE-2020-24370","BIT-lua-2020-24370","DEBIAN-CVE-2020-24370","DLA-2381-1","DLA-3469-1","EUVD-2020-17102","GHSA-gfr4-c37g-mm3v","JLSEC-2026-555","MGASA-2020-0362","OESA-2024-2169","OESA-2025-1278","OESA-2025-1279","OESA-2025-1280","OESA-2025-1281","OESA-2025-1301","RHSA-2021:4510","RLSA-2021:4510","SUSE-SU-2021:2196-1","openSUSE-SU-2021:0962-1","openSUSE-SU-2021:2196-1","openSUSE-SU-2024:11028-1","openSUSE-SU-2024:11029-1","openSUSE-SU-2025:15401-1"],"status":"published","title":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal,...","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03833,"percentile":0.9019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-191"],"published":"2020-08-17T00:00:00Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"RenukaSelvar/lua_CVE-2020-24370","title":"RenukaSelvar/lua_CVE-2020-24370","date":"2024-11-06","url":"https://github.com/RenukaSelvar/lua_CVE-2020-24370"},{"source":"pocgithub","id":"RenukaSelvar/lua_CVE-2020-24370_AfterPatch","title":"RenukaSelvar/lua_CVE-2020-24370_AfterPatch","date":"2024-11-06","url":"https://github.com/RenukaSelvar/lua_CVE-2020-24370_AfterPatch"}],"fixes":[{"ecosystem":"AlmaLinux:8","package":"lua","fixed_in":["5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lua-devel","fixed_in":["5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"lua-libs","fixed_in":["5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"lua","fixed_in":["5.4.6-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"lua","fixed_in":["5.2.4","5.3.6","5.4.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lua5.3","fixed_in":["5.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lua5.3","fixed_in":["5.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lua5.3","fixed_in":["5.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lua5.4","fixed_in":["5.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lua5.4","fixed_in":["5.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lua5.4","fixed_in":["5.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"lua5.3","fixed_in":["5.3.3-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Lua_jll","fixed_in":["5.3.6+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"lua","fixed_in":["5.2.4-3.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"lua5.3","fixed_in":["5.3.5-2.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"lua","fixed_in":["5.3.5-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"syslinux","fixed_in":["6.04-17.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"syslinux","fixed_in":["6.04-17.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"syslinux","fixed_in":["6.04-17.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"syslinux","fixed_in":["6.04-17.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"syslinux","fixed_in":["6.04-15.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua-debuginfo","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua-debugsource","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua-libs-debuginfo","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-debuginfo","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-debugsource","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-libs","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-libs-debuginfo","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-debuginfo","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-debugsource","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-devel","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-libs-debuginfo","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"lua","fixed_in":["0:5.3.4-12.el8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lua-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"lua-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.6-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"lua","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"},{"introduced":"5.3.0"},{"fixed":"5.3.6"},{"introduced":"5.4.0"},{"fixed":"5.4.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lua5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lua5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lua5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lua5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lua5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lua5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"lua5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-1+deb9u1"}]}],"versions":["5.3.3-1"]},{"source":"osv","ecosystem":"Debian:10","package":"lua5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-1.1+deb10u1"}]}],"versions":["5.3.3-1.1"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"Lua_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.3.6+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-3.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"lua5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.5-2.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.5-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.04-17.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.04-17.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.04-17.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.04-17.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"syslinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.04-15.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"lua-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lua-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"lua-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.4-12.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"lua53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"lua53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"lua53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"lua53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-lp152.5.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"lua53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lua55","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.0~beta1-1.1"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"lua","product":"lua"}],"references":[{"url":"http://lua-users.org/lists/lua-l/2020-07/msg00324.html","tags":["x_transferred","Exploit","Mailing List","Vendor Advisory","advisory","evidence","web"]},{"url":"https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb17868ab7b","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00019.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html","tags":["mailing-list","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24370","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ"},{"url":"https://github.com/advisories/GHSA-gfr4-c37g-mm3v"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4510.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-24370","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-24370","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-24370","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0362.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27213","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2169","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1278","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1279","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1280","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1281","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1301","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4510","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870290","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4510.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-24370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24370","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4510","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212196-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175448","tags":["report"]},{"url":"https://bugzilla.suse.com/1175449","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24371","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OOVDNMRFDTKUTT25LOX5ABPHFFAREA4V/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EASBVV4MIBIGZHO5CD23ITJBJVVHVDEU/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-33099","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-24370","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2020-08-17T00:00:00Z","modified":"2024-08-04T15:12:08.645Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2020-17102","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2020-08-17T00:00:00Z","modified":"2024-08-04T15:12:08Z","updated_at":"2026-11-03T03:07:20.249898Z"}],"ghsa":[{"id":"GHSA-gfr4-c37g-mm3v","title":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal,...","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2022-05-24T17:26:02Z","modified":"2024-09-09T15:31:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:58:12.499572Z"}],"nvd":[{"id":"CVE-2020-24370","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2020-08-17T17:15:13.877Z","modified":"2026-06-17T03:05:26.83Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:06:13.05572Z"}],"osv":[{"id":"AZL-41149","title":"CVE-2020-24370 affecting package lua for versions less than 5.4.6-1","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2020-08-17T17:15:13Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"BELL-CVE-2020-24370","title":"CVE-2020-24370 does not affect BellSoft software","status":"withdrawn","published":"2020-08-17T17:15:00Z","modified":"2026-01-26T09:49:36.785208Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-24370","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2020-08-17T17:15:13.877Z","modified":"2026-10-20T13:56:57.848351237Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-24370","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2020-08-17T17:15:13.877Z","modified":"2026-10-26T12:01:02.515172986Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"JLSEC-2026-555","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2026-05-26T19:45:06.761Z","modified":"2026-07-18T00:02:10.862291165Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2024-2169","title":"lua security update","description":"Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description.\r\n\r\nSecurity Fix(es):\r\n\r\nldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)","status":"published","published":"2024-09-27T11:07:38Z","modified":"2026-08-18T01:17:33.126196008Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2025-1278","title":"syslinux security update","description":"The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable \u0026amp;quot;El Torito\u0026amp;quot; CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.\r\n\r\nSecurity Fix(es):\n\nldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)","status":"published","published":"2025-03-14T11:08:22Z","modified":"2026-08-18T01:17:49.63417136Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1279","title":"syslinux security update","description":"The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable \u0026amp;quot;El Torito\u0026amp;quot; CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.\r\n\r\nSecurity Fix(es):\n\nldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)","status":"published","published":"2025-03-14T11:08:22Z","modified":"2026-08-18T01:17:49.663810493Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1280","title":"syslinux security update","description":"The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable \u0026amp;quot;El Torito\u0026amp;quot; CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.\r\n\r\nSecurity Fix(es):\n\nldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)","status":"published","published":"2025-03-14T11:08:22Z","modified":"2026-08-18T01:17:49.557733158Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1281","title":"syslinux security update","description":"The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable \u0026amp;quot;El Torito\u0026amp;quot; CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.\r\n\r\nSecurity Fix(es):\n\nldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)","status":"published","published":"2025-03-14T11:08:22Z","modified":"2026-08-18T01:17:49.599238749Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1301","title":"syslinux security update","description":"The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable \u0026amp;quot;El Torito\u0026amp;quot; CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.\r\n\r\nSecurity Fix(es):\n\nldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:18:49.385568148Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2021:4510","title":"Red Hat Security Advisory: lua security update","status":"published","published":"2024-09-16T06:19:33Z","modified":"2026-06-26T12:21:17.228774252Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4510","title":"Low: lua security update","description":"The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language.\n\nSecurity Fix(es):\n\n* lua: segmentation fault in getlocal and setlocal functions in ldebug.c (CVE-2020-24370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:37:44Z","modified":"2026-02-05T10:15:04.09096Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"ALSA-2021:4510","title":"Low: lua security update","description":"The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language.\n\nSecurity Fix(es):\n\n* lua: segmentation fault in getlocal and setlocal functions in ldebug.c (CVE-2020-24370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:37:44Z","modified":"2026-10-29T11:01:40.566978415Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-lua-2020-24370","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).","status":"published","published":"2024-03-06T10:56:50.799Z","modified":"2026-09-08T08:48:09.334628012Z","updated_at":"2026-11-02T15:28:32.645004Z"},{"id":"DLA-2381-1","title":"lua5.3 - security update","status":"published","published":"2020-09-26T00:00:00Z","modified":"2026-03-09T01:20:30.989242Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-3469-1","title":"lua5.3 - security update","status":"published","published":"2023-06-23T00:00:00Z","modified":"2026-03-09T01:19:05.586852Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2020-0362","title":"Updated lua and lua5.3 packages fix security vulnerability","description":"ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault\nin getlocal and setlocal, as demonstrated by getlocal(3,2^31).\n(CVE-2020-24370)\n","status":"published","published":"2020-09-04T09:16:18Z","modified":"2026-04-16T04:43:37.236491464Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:0962-1","title":"Security update for lua53","description":"This update for lua53 fixes the following issues:\n\nUpdate to version 5.3.6:\n\n- CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)\n- CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)\n- Long brackets with a huge number of '=' overflow some internal buffer arithmetic.\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-07-02T18:06:38Z","modified":"2026-02-04T04:34:05.2917Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2196-1","title":"Security update for lua53","description":"This update for lua53 fixes the following issues:\n\nUpdate to version 5.3.6:\n\n- CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)\n- CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)\n- Long brackets with a huge number of '=' overflow some internal buffer arithmetic.\n","status":"published","published":"2021-07-10T18:53:36Z","modified":"2026-02-04T04:03:27.306128Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11028-1","title":"liblua5_3-5-32bit-5.3.6-1.6 on GA media","description":"These are all security issues fixed in the liblua5_3-5-32bit-5.3.6-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:17:54.299192Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11029-1","title":"liblua5_4-5-32bit-5.4.3-4.2 on GA media","description":"These are all security issues fixed in the liblua5_4-5-32bit-5.4.3-4.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:54.017651Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2025:15401-1","title":"liblua5_5-5-5.5.0~beta1-1.1 on GA media","description":"These are all security issues fixed in the liblua5_5-5-5.5.0~beta1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-03T00:00:00Z","modified":"2026-03-23T04:53:43.51161Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2021:2196-1","title":"Security update for lua53","description":"This update for lua53 fixes the following issues:\n\nUpdate to version 5.3.6:\n\n- CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)\n- CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)\n- Long brackets with a huge number of '=' overflow some internal buffer arithmetic.\n","status":"published","published":"2021-06-29T07:41:54Z","modified":"2026-02-04T03:20:15.624872Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}