Re: Lua 5.1.4

["Steven M. Christey" <coley () linus mitre org>]

Note that the typical CVE criterion for flagging language-interpreter bugs
is that they should be exploitable/reachable through the language API in
reasonable scenarios for the application.  Otherwise, it's the application
developer attacking himself/herself.  I know nothing about Lua so can't
interpret items like #6 and #8, whereas you could imagine malicious input
being processed by unpack().

- Steve