linux/poky.git/meta/recipes-devtools/lua/lua_5.4.4.bb, branch yocto-4.0.1 Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-4.0.1 2022-04-19T13:02:13+00:00 lua: fix CVE-2022-28805 2022-04-19T13:02:13+00:00 Steve Sakoman steve@sakoman.com 2022-04-18T19:04:08+00:00 urn:sha1:91e14d3a8e6e67267047473f5c449f266b44f354 singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code. https://nvd.nist.gov/vuln/detail/CVE-2022-28805 (From OE-Core rev: d2ba3b8850d461bc7b773240cdf15b22b31a3f9e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> lua: upgrade 5.4.3 -> 5.4.4 2022-02-05T17:46:05+00:00 Alexander Kanavin alex.kanavin@gmail.com 2022-02-02T18:27:42+00:00 urn:sha1:02a8a2c621183b26d912b4d68916fbbcf9e98580 (From OE-Core rev: 734cdfddd2d2a0a0e3be2b577bd4175a2abd73e5) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>