CVE-2015-8080
13.04.2016, 15:59
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redislabs | redis | 2.8.0 ≤ 𝑥 < 2.8.24 |
| redislabs | redis | 3.0.0 ≤ 𝑥 < 3.0.6 |
| redislabs | redis | 5.0.0 ≤ 𝑥 < 5.0.8 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.2 |
| redhat | openstack | 6.0 |
| redhat | openstack | 7.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References