CVE-2006-0207
MEDIUM severity · CVSS 5 · Code injection
5CVSS MEDIUM
Summary
Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impactNone
Exploit probability (EPSS)4%
AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://secunia.com/advisories/18431 ↗
Additional information
- NVD record
- http://secunia.com/advisories/18431Patch
- http://secunia.com/advisories/18697Patch
- http://secunia.com/advisories/19179Patch
- http://secunia.com/advisories/19355Patch
- http://securitytracker.com/id?1015484Patch
- http://secunia.com/advisories/19012Advisory
- http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html
- http://secunia.com/advisories/25945