CVE-2014-5461
CVE-2014-5461 is a medium-severity vulnerability in Lua with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 12% places it in the 96th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-119.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 12% (96th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-119
- Affected product: Lua
- Published:
- Last modified:
Description
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
Frequently asked questions
- What is CVE-2014-5461?
- Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- How severe is CVE-2014-5461?
- CVE-2014-5461 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2014-5461 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 12% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-5461?
- CVE-2014-5461 primarily affects Lua. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-5461?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-5461 published?
- CVE-2014-5461 was published on 2014-09-04 and last updated on 2026-06-17.
References
- http://advisories.mageia.org/MGASA-2014-0414.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00030.html
- http://secunia.com/advisories/59890
- http://secunia.com/advisories/60869
- http://secunia.com/advisories/61411
- http://www.debian.org/security/2014/dsa-3015
- http://www.debian.org/security/2014/dsa-3016
- http://www.lua.org/bugs.html#5.2.2-1
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:144
- http://www.openwall.com/lists/oss-security/2014/08/21/1
- http://www.openwall.com/lists/oss-security/2014/08/21/4
- http://www.openwall.com/lists/oss-security/2014/08/27/2
- http://www.securityfocus.com/bid/69342
- http://www.ubuntu.com/usn/USN-2338-1
- https://security.gentoo.org/glsa/201701-53
- https://security.gentoo.org/glsa/202305-23
Affected products (16)
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*
- cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*
More vulnerabilities in Lua
- CVE-2020-15889 — Critical (CVSS 9.8): Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an…
- CVE-2022-28805 — Critical (CVSS 9.1): singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call,…
- CVE-2020-15888 — High (CVSS 8.8): Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based…
- CVE-2020-24342 — High (CVSS 7.8): Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls…
- CVE-2021-45985 — High (CVSS 7.5): In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.
- CVE-2022-33099 — High (CVSS 7.5): An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error…
Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities
- CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
- CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
- CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
- CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
- CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
- CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.