{"id":"CVE-2020-15945","details":"Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.","aliases":["BIT-lua-2020-15945"],"modified":"2026-07-08T20:58:38.883397Z","published":"2020-07-24T21:15:34.553Z","related":["openSUSE-SU-2024:11029-1","openSUSE-SU-2025:15401-1"],"references":[{"type":"WEB","url":"https://www.lua.org/bugs.html#5.4.0-8"},{"type":"FIX","url":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3"},{"type":"EVIDENCE","url":"http://lua-users.org/lists/lua-l/2020-07/msg00123.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lua/lua","events":[{"introduced":"a1415c0d72053cf6f6f7e68033fa3b7f999ad960"},{"fixed":"c33b1728aeb7dfeec4013562660e07d32697aa6b"},{"fixed":"a2195644d89812e5b157ce7bac35543e06db05e3"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.3.1"},{"fixed":"5.4.0"}]}}],"versions":["v5.4.0","v5.4-beta","v5.4-alpha","v5.3.4","v5.4-w2","v5.3.3","v5.3.2","v5.3.1"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"lstate.c"},"deprecated":false,"digest":{"line_hashes":["287192634004727551527939586181924269932","274255088578381943778602658044565137928","302130712472896979106335948257183954877","312214899722359748752012827686809810105"],"threshold":0.9},"id":"CVE-2020-15945-19c6daf9","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"function":"lua_sethook","file":"ldebug.c"},"deprecated":false,"digest":{"function_hash":"62736101661873712014908231113714947026","length":385},"id":"CVE-2020-15945-47c36360","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"lstate.h"},"deprecated":false,"digest":{"line_hashes":["95429948575861376923991588268707015234","273864006021711298157286354081182832124","67704214408290045091901196539613708583","311697270559889404826088760805203031801","36929269663881341534977643666069435582","231607116081866341391134113829397259525","141542653895552926429558482152744119849","323905404835571947602237650310697985964"],"threshold":0.9},"id":"CVE-2020-15945-5b967efd","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"lvm.c","function":"luaV_execute"},"deprecated":false,"digest":{"function_hash":"306508976492688483867018714090201110428","length":15864},"id":"CVE-2020-15945-5e1e5728","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"lstate.c","function":"preinit_thread"},"deprecated":false,"digest":{"function_hash":"73228160749920847031617698733708159911","length":429},"id":"CVE-2020-15945-965e3f8a"},{"source":"https://github.com/lua/lua/commit/c33b1728aeb7dfeec4013562660e07d32697aa6b","target":{"file":"lundump.c"},"deprecated":false,"digest":{"line_hashes":["269810539898441432084375873056413305695","94841326714320640054029841580820134840","40651803659392017926119780708317107103","65711734181821478689241043987561089536","263241472982263666473150805611088246470","181095254349098211930480489324584086081"],"threshold":0.9},"id":"CVE-2020-15945-9d05e058","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/lua/lua/commit/c33b1728aeb7dfeec4013562660e07d32697aa6b","target":{"file":"lundump.c","function":"luaU_undump"},"deprecated":false,"digest":{"length":667,"function_hash":"238069169988053746266824661283418593084"},"id":"CVE-2020-15945-a19ba564","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"ldo.c"},"deprecated":false,"digest":{"line_hashes":["246844241350974247765303425970524980700","47851809143420456851929641194009130726","61084527410730799872259490356942813921","244740145454364051445274161567570188684","169960933616533054554593504748967283997","207238067517948898418237346196745869579","250490646186909752362845643965329409555","107123582922510385313572946610566578068","174519258625272331544025819313287915673"],"threshold":0.9},"id":"CVE-2020-15945-ae44ab38","signature_type":"Line"},{"source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"ldo.c","function":"rethook"},"deprecated":false,"digest":{"function_hash":"123489847259203439377481335534468369504","length":732},"id":"CVE-2020-15945-beea6195","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"function":"luaG_traceexec","file":"ldebug.c"},"deprecated":false,"digest":{"length":1177,"function_hash":"294202383311931165159724760380940233711"},"id":"CVE-2020-15945-d242d89d","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["164996234144512580017478739116976845737","117643623070754041812545032044414062455","188155607413772914816611264750391157288","55047227023161513365280177439093216419","174541184384929750357419476106665318513","289296978187595691772109228634836685181","103413706918097626829061777227705613525","39703345779430427769702986375944428705","118413824755669859290850840685638792814","326105908386207216637035167587097721374","253131680156336864839643148664388157824","257154967245482473974603034905532593743","8866757965152967660475381109002430932","283583517597706205043460995415619269999","252187278128377095359608730677865696776","113592560286193111120549654207022825160","306864358839741255107307737154717712309","136528560185200778266864045689498551408","114069259250585297629443527745879968827","256155706389959878623957988551946673458","329832938051680175797582163019189067310","336001841472458717705245979156270884108","179695158233417394524558382259840005928","221257756573081795167020732963033694031","29080699811238547596693091638563942825","129250242227833116354386067425791631450","119039124302107785144697284946045946194","73403090988095296428900197732391942108","133080238017401727040127613538182971170","48215149572452346017214009213839261661","107794786123033825083228400348781777413","72695911509914351619695244957656273762"],"threshold":0.9},"id":"CVE-2020-15945-defa0c6a","signature_type":"Line","signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"ldebug.c"}},{"id":"CVE-2020-15945-e0696b47","signature_type":"Line","signature_version":"v1","source":"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3","target":{"file":"lvm.c"},"deprecated":false,"digest":{"line_hashes":["2493347623197736049285124519438679755","258756140125734514204832612276739303603","336906736912328082593578869120484310608","116753382556258310902612286018217057081"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15945.json","vanir_signatures_modified":"2026-07-08T20:58:38Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}