lua5.3 - Debian Package Tracker

general

source: lua5.3 (main)
version: 5.3.6-1
maintainer: Debian Lua Team (archive) (DMD)
uploaders: Ondřej Surý [DMD]
arch: any
std-ver: 3.9.8
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.3.3-1
o-o-sec: 5.3.3-1+deb9u1
oldstable: 5.3.3-1.1
stable: 5.3.3-1.1
testing: 5.3.6-1
unstable: 5.3.6-1

versioned links

5.3.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.3.3-1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.3.3-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.3.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

liblua5.3-0
liblua5.3-0-dbg
liblua5.3-dev
lua5.3 (2 bugs: 0, 2, 0, 0)

action needed

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 3.9.8).

Created: 2017-07-14 Last update: 2022-05-11 23:25

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2021-43519: Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

Created: 2021-11-10 Last update: 2022-04-29 19:32

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2021-43519: Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

Created: 2021-11-10 Last update: 2022-04-29 19:32

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2021-08-14 Last update: 2022-05-27 22:01

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 800dc952d7078e6ac75bc4adfc2103a6244da899
Author: Jenkins <jenkins@jenkins.debian.net>
Date:   Tue Oct 12 17:30:57 2021 +0000

    Use secure URI in Homepage field.
    
    Changes-By: lintian-brush
    Fixes: lintian: homepage-field-uses-insecure-uri
    See-also: https://lintian.debian.org/tags/homepage-field-uses-insecure-uri.html

Created: 2018-12-28 Last update: 2022-05-26 22:10

3 low-priority security issues in buster low

There are 3 open security issues in buster.

3 issues left for the package maintainer to handle:

CVE-2019-6706: (postponed; to be fixed through a stable update) Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
CVE-2020-24370: (needs triaging) ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).
CVE-2021-43519: (needs triaging) Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-02-19 Last update: 2022-04-29 19:32

3 low-priority security issues in bullseye low

There are 3 open security issues in bullseye.

3 issues left for the package maintainer to handle:

CVE-2019-6706: (postponed; to be fixed through a stable update) Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
CVE-2020-24370: (needs triaging) ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).
CVE-2021-43519: (needs triaging) Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-08-14 Last update: 2022-04-29 19:32

news

[rss feed]

[2021-10-18] lua5.3 5.3.6-1 MIGRATED to testing (Debian testing watch)
[2021-10-12] Accepted lua5.3 5.3.6-1 (source) into unstable (Bastian Germann)
[2020-09-26] Accepted lua5.3 5.3.3-1+deb9u1 (source) into oldstable (Roberto C. Sanchez)
[2019-01-03] lua5.3 5.3.3-1.1 MIGRATED to testing (Debian testing watch)
[2018-12-28] Accepted lua5.3 5.3.3-1.1 (source amd64) into unstable (Dima Kogan)
[2017-07-14] Accepted lua5.3 5.3.3-1~bpo8+1 (source amd64) into jessie-backports->backports-policy, jessie-backports (Vincent Bernat)
[2016-12-31] lua5.3 5.3.3-1 MIGRATED to testing (Debian testing watch)
[2016-12-19] Accepted lua5.3 5.3.3-1 (source amd64) into unstable (Ondřej Surý)
[2016-08-11] lua5.3 5.3.1-1.1 MIGRATED to testing (Debian testing watch)
[2016-08-05] Accepted lua5.3 5.3.1-1.1 (source) into unstable (Aurelien Jarno)
[2016-01-10] Accepted lua5.3 5.3.1-1~bpo7+1 (source amd64) into wheezy-backports-sloppy, wheezy-backports-sloppy (Vincent Bernat)
[2016-01-01] Accepted lua5.3 5.3.1-1~bpo8+1 (source amd64) into jessie-backports, jessie-backports (Vincent Bernat)
[2015-08-21] lua5.3 5.3.1-1 MIGRATED to testing (Britney)
[2015-08-15] Accepted lua5.3 5.3.1-1 (source amd64) into unstable, unstable (Enrico Tassi)

bugs [bug history graph]

all: 5
RC: 0
I&N: 4
M&W: 1
F&P: 0
patch: 1

links

homepage
lintian
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.3.6-1build1
1 bug