CVE-2022-28805
mediumpriority · track · 37EPSS 0.030 · 87 %ileDEEURUUSEPSS · scored 2026-10-27
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (16)
Products and version ranges known to be affected.
- Xerox FreeFlow Print Server v7 for Solarisall versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v7_for_solaris
advisories (5)
Vendor and ecosystem advisories describing this.
- SCA-2025-0006Vulnerability affecting picoScan and multiScan2025-04-28csaf · sick_psirtDE
SICK has identified a Denial of Service vulnerability (CVE-2025-32472) in picoScan and multiScan, which can cause the web page to become unresponsive. Due to their architectural design, these products are not affected by the other vulnerabilities listed in this advisory. Currently SICK is not aware of any public exploits specifically targeting the vulnerability. SICK recommends applying the mitigation for CVE-2025-32472.
- WID-SEC-W-2023-1185Red Hat Enterprise Linux: Mehrere SchwachstellenDeutsch2023-05-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, seine Privilegien zu erweitern und Daten zu manipulieren.
- WID-SEC-W-2023-1542Red Hat OpenShift: Mehrere SchwachstellenDeutsch2023-06-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2023-2031Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-08-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- BIT-lua-2022-288052024-03-06vendor · osvUS
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (27)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2022-28805cnnvd
- https://cxsecurity.com/cveshow/CVE-2022-28805/cnnvd
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030facnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/cnnvd
- https://lua-users.org/lists/lua-l/2022-02/msg00001.htmlcnnvd
- https://lua-users.org/lists/lua-l/2022-02/msg00070.htmlcnnvd
- https://lua-users.org/lists/lua-l/2022-04/msg00009.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan