Medium
Security advisory
Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-15945
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:34 UTC · Revision 1
Source evidence
Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.
osv:CVE-2020-15945
Complete source record
{
"id": "ad604008959dd602645e8b81b0d5200302cc0df2f8b15fe824b5d809ce887467",
"url": "https://osv.dev/vulnerability/CVE-2020-15945",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-15945",
"summary": "Lua 5.4.0 (fixed in 5.4.1) has a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.",
"evidence": "osv:CVE-2020-15945",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-15945",
"aliases": [
"BIT-lua-2020-15945",
"CVE-2020-15945"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/lua/lua",
"type": "GIT",
"events": [
{
"introduced": "a1415c0d72053cf6f6f7e68033fa3b7f999ad960"
},
{
"fixed": "c33b1728aeb7dfeec4013562660e07d32697aa6b"
},
{
"fixed": "a2195644d89812e5b157ce7bac35543e06db05e3"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.3.1"
},
{
"fixed": "5.4.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "a2195644d89812e5b157ce7bac35543e06db05e3"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v5.4-beta",
"v5.4-alpha",
"v5.3.4",
"v5.4-w2",
"v5.3.3",
"v5.3.2",
"v5.3.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15945.json",
"vanir_signatures": [
{
"id": "CVE-2020-15945-19c6daf9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287192634004727551527939586181924269932",
"274255088578381943778602658044565137928",
"302130712472896979106335948257183954877",
"312214899722359748752012827686809810105"
]
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "lstate.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-47c36360",
"digest": {
"length": 385,
"function_hash": "62736101661873712014908231113714947026"
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "ldebug.c",
"function": "lua_sethook"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-5b967efd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95429948575861376923991588268707015234",
"273864006021711298157286354081182832124",
"67704214408290045091901196539613708583",
"311697270559889404826088760805203031801",
"36929269663881341534977643666069435582",
"231607116081866341391134113829397259525",
"141542653895552926429558482152744119849",
"323905404835571947602237650310697985964"
]
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "lstate.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-5e1e5728",
"digest": {
"length": 15864,
"function_hash": "306508976492688483867018714090201110428"
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "lvm.c",
"function": "luaV_execute"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-965e3f8a",
"digest": {
"length": 429,
"function_hash": "73228160749920847031617698733708159911"
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "lstate.c",
"function": "preinit_thread"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-9d05e058",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269810539898441432084375873056413305695",
"94841326714320640054029841580820134840",
"40651803659392017926119780708317107103",
"65711734181821478689241043987561089536",
"263241472982263666473150805611088246470",
"181095254349098211930480489324584086081"
]
},
"source": "https://github.com/lua/lua/commit/c33b1728aeb7dfeec4013562660e07d32697aa6b",
"target": {
"file": "lundump.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-a19ba564",
"digest": {
"length": 667,
"function_hash": "238069169988053746266824661283418593084"
},
"source": "https://github.com/lua/lua/commit/c33b1728aeb7dfeec4013562660e07d32697aa6b",
"target": {
"file": "lundump.c",
"function": "luaU_undump"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-ae44ab38",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246844241350974247765303425970524980700",
"47851809143420456851929641194009130726",
"61084527410730799872259490356942813921",
"244740145454364051445274161567570188684",
"169960933616533054554593504748967283997",
"207238067517948898418237346196745869579",
"250490646186909752362845643965329409555",
"107123582922510385313572946610566578068",
"174519258625272331544025819313287915673"
]
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "ldo.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-beea6195",
"digest": {
"length": 732,
"function_hash": "123489847259203439377481335534468369504"
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "ldo.c",
"function": "rethook"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-d242d89d",
"digest": {
"length": 1177,
"function_hash": "294202383311931165159724760380940233711"
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "ldebug.c",
"function": "luaG_traceexec"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-defa0c6a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164996234144512580017478739116976845737",
"117643623070754041812545032044414062455",
"188155607413772914816611264750391157288",
"55047227023161513365280177439093216419",
"174541184384929750357419476106665318513",
"289296978187595691772109228634836685181",
"103413706918097626829061777227705613525",
"39703345779430427769702986375944428705",
"118413824755669859290850840685638792814",
"326105908386207216637035167587097721374",
"253131680156336864839643148664388157824",
"257154967245482473974603034905532593743",
"8866757965152967660475381109002430932",
"283583517597706205043460995415619269999",
"252187278128377095359608730677865696776",
"113592560286193111120549654207022825160",
"306864358839741255107307737154717712309",
"136528560185200778266864045689498551408",
"114069259250585297629443527745879968827",
"256155706389959878623957988551946673458",
"329832938051680175797582163019189067310",
"336001841472458717705245979156270884108",
"179695158233417394524558382259840005928",
"221257756573081795167020732963033694031",
"29080699811238547596693091638563942825",
"129250242227833116354386067425791631450",
"119039124302107785144697284946045946194",
"73403090988095296428900197732391942108",
"133080238017401727040127613538182971170",
"48215149572452346017214009213839261661",
"107794786123033825083228400348781777413",
"72695911509914351619695244957656273762"
]
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "ldebug.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15945-e0696b47",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2493347623197736049285124519438679755",
"258756140125734514204832612276739303603",
"336906736912328082593578869120484310608",
"116753382556258310902612286018217057081"
]
},
"source": "https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3",
"target": {
"file": "lvm.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:52:31Z"
}
}
],
"modified": "2026-10-20T13:52:31.401486757Z",
"provider": "osv",
"references": [
"https://www.lua.org/bugs.html#5.4.0-8",
"https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-15945",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388328,
"published_at": "2020-07-24T21:15:34.553+00:00"
}