Advisory ROSA-SA-2021-1910

Software: lua 5.1.4
OS: Cobalt 7.9

CVE-ID: CVE-2020-15888
CVE-Crit: HIGH
CVE-DESC: Lua through 5.4.0 incorrectly handles the interaction between stack resizing and garbage collection, resulting in heap-based buffer overflow, heap-based buffer overflow, or post-release usage.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2020-15945
CVE-Crit: MEDIUM
CVE-DESC: Lua through 5.4.0 has a segmentation error in changedline in ldebug.c (e.g., when calling luaG_traceexec) because it incorrectly expects that the value of oldpc is always updated when the control flow returns to the function.
CVE-STATUS: default
CVE-REV: default