CVE-2014-5461
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows...
CVE-2014-5461 is a medium vulnerability (CVSS 5.0) in Lua, published August 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.0%, the 96th percentile. Fixed in ceph 18.2.2-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 12.0%EPSS, 96th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
18.2.2-1ceph +16 more
Description
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cephAzure Linux:3 | before 18.2.2-1 | 18.2.2-1 |
compat-luaAzure Linux:3 | through 5.1.5-17 | None known |
lua5.1Debian:12 | before 5.1.5-7 | 5.1.5-7 |
lua5.1Debian:13 | before 5.1.5-7 | 5.1.5-7 |
lua5.1Debian:14 | before 5.1.5-7 | 5.1.5-7 |
lua5.2Debian:12 | before 5.2.3-1 | 5.2.3-1 |
lua5.2Debian:13 | before 5.2.3-1 | 5.2.3-1 |
lua5.2Debian:14 | before 5.2.3-1 | 5.2.3-1 |
lua5.1Debian:6.0 | before 5.1.4-5+deb6u1, plus listed versions 5.1.4-5 | 5.1.4-5+deb6u1 |
lua5.1Debian:7 | before 5.1.5-4+deb7u1, plus listed versions 5.1.5-4 | 5.1.5-4+deb7u1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lua5.2Debian:7 | before 5.2.1-3+deb7u1, plus listed versions 5.2.1-3 | 5.2.1-3+deb7u1 |
lua5.1Mageia:3 | before 5.1.5-2.2.mga3 | 5.1.5-2.2.mga3 |
luaMageia:3 | before 5.2.2-1.1.mga3 | 5.2.2-1.1.mga3 |
lua5.1Mageia:4 | before 5.1.5-4.1.mga4 | 5.1.5-4.1.mga4 |
luaMageia:4 | before 5.2.2-2.1.mga4 | 5.2.2-2.1.mga4 |
lua5.1Ubuntu:14.04:LTS | before 5.1.5-5ubuntu0.1, plus listed versions 5.1.5-5 | 5.1.5-5ubuntu0.1 |
moarvmopenSUSE:Tumbleweed | before 2025.05-1.1 | 2025.05-1.1 |
What each source reports
NVD Score used
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
CVE-2014-5461- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
CVE-2014-5461- Updated
- 2026-11-02
EUVDEUVD-2014-5348No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
EUVD-2014-5348- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3hh-4h88-w4mrNo score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows...
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
GHSA-v3hh-4h88-w4mr- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVAZL-41108No score
CVE-2014-5461 affecting package ceph for versions less than 18.2.2-1
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
AZL-41108- Updated
- 2026-11-05
OSVAZL-45036No score
CVE-2014-5461 affecting package compat-lua 5.1.5-17
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
AZL-45036- Updated
- 2026-11-05
Show 6 moreShow less
OSVNo score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
CVE-2014-5461- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5461No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
DEBIAN-CVE-2014-5461- Updated
- 2026-11-02
OSVMGASA-2014-0414No score
Updated lua and lua5.1 packages fix security vulnerability
A heap-based overflow vulnerability was found in the way Lua handles varargs functions with many fixed parameters called with few arguments, leading to application crashes or, potentially, arbitrary code execution (CVE-2014-5461).
- Record
MGASA-2014-0414- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15247-1No score
moarvm-2025.05-1.1 on GA media
These are all security issues fixed in the moarvm-2025.05-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15247-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-5461No score
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- Record
UBUNTU-CVE-2014-5461- Updated
- 2026-11-02
OSVUSN-2338-1No score
lua5.1 vulnerability
It was discovered that Lua incorrectly handled certain vararg functions with a large number of fixed parameters. An attacker could use this issue to cause Lua applications to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-2338-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2014/08/21/4
ubuntu.com/usn/USN-2338-1
security.gentoo.org/glsa/201701-53
securityfocus.com/bid/69342
secunia.com/advisories/59890
Show 18 moreShow less
mandriva.com/security/advisories?name=MDVSA-2015:144
debian.org/security/2014/dsa-3016
lua.org/bugs.html
lists.opensuse.org/opensuse-updates/2014-09/msg00030.html
advisories.mageia.org/MGASA-2014-0414.html
nvd.nist.gov/vuln/detail/CVE-2014-5461
github.com/advisories/GHSA-v3hh-4h88-w4mr
security-tracker.debian.org/tracker/CVE-2014-5461
bugs.mageia.org/show_bug.cgi?id=14038
ubuntu.com/security/CVE-2014-5461
cve.org/CVERecord?id=CVE-2014-5461
suse.com/security/cve/CVE-2014-5461