Buffer overflow in Apache Org.apache.sling.servlets.post
CVE-2013-2254
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have pe…
Vulnerability class: Buffer Overflow
EPSS: 0.010 (77.3th percentile) — read the EPSS interpretation.
Affected products
- Apache Org.apache.sling.servlets.post — versions 2.2.0, 2.3.0
- Apache Sling
- N/a — versions n/a
Weakness classification (CWE)
References
- [sling-dev] 20131009 [CVE-2013-2254] Apache Sling denial of service vulnerability (Vendor Advisory, mailing-list, x_refsource_MLIST)
- 55157 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- 62903 (vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
- apache-sling-cve20132254-dos(87765) (vdb-entry, x_refsource_XF)