CVE-2019-6706: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 17.4% chance of exploitation in the next 30 days.

Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 18.10 only
• Lua Lua: version 5.3.5 only

Published 2019-01-23. Last modified 2026-06-17.