Every CVESearch/Get API key

CVE-2011-1398

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does...

4.3 MediumPublic exploit

CVE-2011-1398 is a medium vulnerability (CVSS 4.3) in Php, published August 30, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. No source names a fixed version.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
10.2%EPSS, 95th percentile
Exploitation
None known1 public exploit
Fixed in
No fix listedNo source names one

Description

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.

Exploit likelihood

10.2%Down 2.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-bcmath
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-cli
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-common
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-dba
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-embedded
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-enchant
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-fpm
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
Show 186 moreShow less
Affected packages
PackageAffectedFixed
php-gd
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-imap
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-intl
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-ldap
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mbstring
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mysql
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-odbc
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pdo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pgsql
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-process
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pspell
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-recode
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-snmp
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-soap
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-tidy
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xml
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xmlrpc
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-zts
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-bcmath
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-dba
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-embedded
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-enchant
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-fpm
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-gd
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-imap
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-intl
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-ldap
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mbstring
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mysql
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-odbc
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pdo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pgsql
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-process
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pspell
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-recode
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-snmp
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-soap
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-tidy
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xml
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xmlrpc
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-zts
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-cli
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-common
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-bcmath
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-dba
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-embedded
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-enchant
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-fpm
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-imap
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-intl
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mbstring
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-process
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pspell
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-recode
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-snmp
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-tidy
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-zts
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-cli
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-common
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-gd
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-ldap
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mysql
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-odbc
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pdo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pgsql
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-soap
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xml
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xmlrpc
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-bcmath
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-dba
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-embedded
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-enchant
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-fpm
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-imap
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-intl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mbstring
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-process
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pspell
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-recode
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-snmp
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-tidy
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-zts
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-cli
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-common
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-gd
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-ldap
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-mysql
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-odbc
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pdo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-pgsql
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-soap
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xml
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php-xmlrpc
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
before 0:5.3.3-22.el6
0:5.3.3-22.el6
php53
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-bcmath
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-cli
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-common
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-dba
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-gd
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-imap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-intl
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-ldap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-mbstring
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-mysql
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-odbc
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-pdo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-pgsql
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-process
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-pspell
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-snmp
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-soap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-xml
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-xmlrpc
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-bcmath
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-cli
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-common
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-dba
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-gd
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-imap
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-intl
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-ldap
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-mbstring
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-mysql
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-odbc
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-pdo
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-pgsql
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-process
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-pspell
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-snmp
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-soap
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-xml
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php53-xmlrpc
Red Hat:enterprise_linux:5::server
From an advisory covering 6 CVEs
before 0:5.3.3-21.el5
0:5.3.3-21.el5
php
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-bcmath
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-cli
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-common
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-dba
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-gd
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-imap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-ldap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-mbstring
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-mysql
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-ncurses
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-odbc
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-pdo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-pgsql
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-snmp
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-soap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-xml
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-xmlrpc
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-bcmath
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-cli
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-common
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-dba
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-gd
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-imap
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-ldap
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-mbstring
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-mysql
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-ncurses
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-odbc
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-pdo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-pgsql
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-snmp
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-soap
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-xml
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10
php-xmlrpc
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:5.1.6-43.el5_10
0:5.1.6-43.el5_10

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPHP 5.3.11/5.4.0RC2 - 'header()' HTTP Header Injection2011-10-06

What each source reports

NVD Score used4.3

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.

Record
CVE-2011-1398
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.

Record
CVE-2011-1398
Updated
2026-11-02
EUVDEUVD-2011-1405No score

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.

Record
EUVD-2011-1405
Updated
2026-11-03
GitHub AdvisoriesGHSA-g6fq-45x6-cmh4No score

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does...

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.

Record
GHSA-g6fq-45x6-cmh4
Weakness
CWE-20
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 58 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open