CVE-2015-8080

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*
cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*
cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2016-04-13 15:59

Updated : 2024-02-28 15:21


NVD link : CVE-2015-8080

Mitre link : CVE-2015-8080

CVE.ORG link : CVE-2015-8080


JSON object : View

Products Affected

opensuse

  • opensuse
  • leap

debian

  • debian_linux

redhat

  • openstack

redislabs

  • redis
CWE
CWE-190

Integer Overflow or Wraparound