CVE-2006-0207: Code Injection
Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0207?
CVE-2006-0207 has been classified with critical severity due to the potential for remote code injection and control over HTTP response headers.
How do I fix CVE-2006-0207?
To fix CVE-2006-0207, upgrade PHP to version 5.1.2 or later, where this issue has been addressed.
What versions of PHP are affected by CVE-2006-0207?
CVE-2006-0207 affects PHP versions 5.1.1, 5.1.0, 5.0.5, 5.0.4, among others, including several release candidates.
How can CVE-2006-0207 be exploited?
Attackers can exploit CVE-2006-0207 by sending specially crafted Set-Cookie headers that allow arbitrary HTTP header injection.
What are the consequences of CVE-2006-0207 exploitation?
Exploitation of CVE-2006-0207 can lead to session hijacking, cookie manipulation, and misdirection of web traffic.