CVE-2020-14147

An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.

• CWE-190
• CWE-787

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.htmlMailing List, Third Party Advisory
• https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571Patch, Third Party Advisory
• https://github.com/antirez/redis/pull/6875Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202008-17Third Party Advisory
• https://www.debian.org/security/2020/dsa-4731Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.htmlMailing List, Third Party Advisory
• https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571Patch, Third Party Advisory
• https://github.com/antirez/redis/pull/6875Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202008-17Third Party Advisory
• https://www.debian.org/security/2020/dsa-4731Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory

Published

Jun 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14131The Xiaomi Security Center expresses heartfelt thanks to ADL…9.8
• CVE-2020-1414An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14140When Xiaomi router firmware is updated in 2020, there is an …7.5
• CVE-2020-14144The git hook feature in Gitea 1.1.0 through 1.12.5 might all…7.2
• CVE-2020-14145The client side in OpenSSH 5.7 through 8.4 has an Observable…5.9
• CVE-2020-14146KumbiaPHP through 1.1.1, in Development mode, allows XSS via…5.4
• CVE-2020-14148The Server-Server protocol implementation in ngIRCd before 2…7.5
• CVE-2020-14149In uftpd before 2.12, handle_CWD in ftpcmd.c mishandled the …7.5
• CVE-2020-1415An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14150GNU Bison before 3.5.4 allows attackers to cause a denial of…5.5
• CVE-2020-14151Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-14152In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in…7.1