The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php-mbstringUpgrade php-commonUpgrade php-mysqlUpgrade php-processUpgrade php-pdoUpgrade php-odbcUpgrade php-xmlrpcUpgrade php-soapUpgrade php-ztsUpgrade php-pgsqlUpgrade php-fpmUpgrade php-develUpgrade php-snmpUpgrade php-cliUpgrade php-tidyUpgrade php-ncursesUpgrade php-recodeUpgrade php-ldapUpgrade php-bcmathUpgrade php-embeddedUpgrade php-enchantUpgrade php-imapUpgrade php-xmlUpgrade phpUpgrade php-gdUpgrade php-pspellUpgrade php-intlUpgrade php-dba | Dec 1, 2016 | Aug 30, 2012 |
| Freebsd | — | Upgrade php53Upgrade php5Upgrade php52 | Dec 10, 2025 | Sep 5, 2012 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Aug 30, 2012 |
| Oracle_linux | — | Upgrade php-xmlUpgrade php53-xmlUpgrade php-processUpgrade php53-xmlrpcUpgrade php53-mysqlUpgrade php53-commonUpgrade php53-soapUpgrade php-recodeUpgrade php-cliUpgrade php53-cliUpgrade php-pspellUpgrade php-mysqlUpgrade php53-develUpgrade php-mbstringUpgrade php53-pspellUpgrade php-gdUpgrade php53-intlUpgrade php53-ldapUpgrade php-snmpUpgrade php-dbaUpgrade php53-pgsqlUpgrade php53-processUpgrade php-soapUpgrade php-xmlrpcUpgrade php-ldapUpgrade php-commonUpgrade php-pdoUpgrade php-develUpgrade php-embeddedUpgrade php-bcmathUpgrade phpUpgrade php53-dbaUpgrade php53-bcmathUpgrade php-intlUpgrade php53-mbstringUpgrade php53-pdoUpgrade php53Upgrade php-enchantUpgrade php-fpmUpgrade php-tidyUpgrade php53-imapUpgrade php-ncursesUpgrade php53-snmpUpgrade php-ztsUpgrade php-pgsqlUpgrade php-odbcUpgrade php53-odbcUpgrade php53-gdUpgrade php-imap | Oct 16, 2024 | Aug 30, 2012 |
| Php | — | Upgrade to PHP version 5.3.11Upgrade to PHP version 5.4.0 | Oct 1, 2012 | Aug 30, 2012 |
| Suse | — | Upgrade php53-mbstringUpgrade php53-wddxUpgrade apache2-mod_php5-debuginfoUpgrade php5-pcntlUpgrade php53-sysvmsgUpgrade php5-fileinfoUpgrade php5-gd-debuginfoUpgrade php5-suhosinUpgrade php5-hashUpgrade php5-bcmath-debuginfoUpgrade php5-mssqlUpgrade php5-sysvshmUpgrade php5-odbc-debuginfoUpgrade php53-bcmathUpgrade php5-intlUpgrade php5-exif-debuginfoUpgrade php5-tidy-debuginfoUpgrade php53-develUpgrade php53-tidyUpgrade php5-imapUpgrade php5-pspellUpgrade php5Upgrade php53-bz2Upgrade php5-shmop-debuginfoUpgrade php5-fpmUpgrade php53-dbaUpgrade php53-mcryptUpgrade php5-pspell-debuginfoUpgrade php53-suhosinUpgrade php5-pgsqlUpgrade php5-gdUpgrade php5-imap-debuginfoUpgrade php5-tokenizer-debuginfoUpgrade php53-gettextUpgrade php53-pgsqlUpgrade php53-pspellUpgrade php5-dba-debuginfoUpgrade php5-xmlrpcUpgrade php5-xmlwriter-debuginfoUpgrade php53-zipUpgrade php53-fileinfoUpgrade php5-gettext-debuginfoUpgrade php5-enchant-debuginfoUpgrade sle-sdk-releaseUpgrade php53-pcntlUpgrade php5-mbstringUpgrade php5-ctype-debuginfoUpgrade php5-xslUpgrade php5-curl-debuginfoUpgrade php5-dbaUpgrade php53-ftpUpgrade php53-pearUpgrade php53-zlibUpgrade php5-readline-debuginfoUpgrade php5-ldapUpgrade php5-fpm-debuginfoUpgrade php53-snmpUpgrade php5-gmpUpgrade php5-ctypeUpgrade php5-wddx-debuginfoUpgrade php53-exifUpgrade php5-sysvsem-debuginfoUpgrade php53-posixUpgrade php5-ldap-debuginfoUpgrade php5-sqlite-debuginfoUpgrade php53-shmopUpgrade php5-calendar-debuginfoUpgrade php5-zlibUpgrade php5-opensslUpgrade php5-pearUpgrade php53-xmlreaderUpgrade php5-xsl-debuginfoUpgrade php53-sysvsemUpgrade php53-gdUpgrade php53-tokenizerUpgrade php5-soapUpgrade php5-sysvmsgUpgrade php53-iconvUpgrade php5-sqliteUpgrade php53-imapUpgrade php5-exifUpgrade php5-mbstring-debuginfoUpgrade php5-xmlreaderUpgrade php5-pdo-debuginfoUpgrade php53Upgrade php5-mcryptUpgrade php5-dom-debuginfoUpgrade php5-socketsUpgrade php5-dbaseUpgrade php5-pgsql-debuginfoUpgrade php5-debugsourceUpgrade php53-sqliteUpgrade php53-calendarUpgrade php5-mcrypt-debuginfoUpgrade php5-sysvmsg-debuginfoUpgrade php5-iconv-debuginfoUpgrade php5-posix-debuginfoUpgrade php5-shmopUpgrade php53-xslUpgrade php5-gmp-debuginfoUpgrade php53-socketsUpgrade php5-phar-debuginfoUpgrade php53-ctypeUpgrade php5-ftp-debuginfoUpgrade php5-domUpgrade php53-opensslUpgrade php5-mhashUpgrade php5-ncursesUpgrade php5-ftpUpgrade apache2-mod_php53Upgrade php5-json-debuginfoUpgrade php53-readlineUpgrade php5-snmp-debuginfoUpgrade php5-fileinfo-debuginfoUpgrade php5-curlUpgrade php5-sysvshm-debuginfoUpgrade php5-pcntl-debuginfoUpgrade php53-xmlwriterUpgrade php53-pdoUpgrade php53-sysvshmUpgrade php53-odbcUpgrade php5-bz2Upgrade php5-xmlreader-debuginfoUpgrade php5-debuginfoUpgrade php5-fastcgiUpgrade php5-iconvUpgrade php53-soapUpgrade php5-suhosin-debuginfoUpgrade php5-odbcUpgrade php5-tidyUpgrade php5-snmpUpgrade php5-intl-debuginfoUpgrade php53-ldapUpgrade php53-fastcgiUpgrade php53-curlUpgrade php5-enchantUpgrade php5-sockets-debuginfoUpgrade php53-xmlrpcUpgrade php53-domUpgrade php53-jsonUpgrade php5-sysvsemUpgrade php5-mysql-debuginfoUpgrade php5-zip-debuginfoUpgrade php5-posixUpgrade php5-tokenizerUpgrade php5-phar | Feb 17, 2015 | Aug 30, 2012 |
| Ubuntu | — | Upgrade php5 | Nov 8, 2024 | Aug 30, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub