← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2011-1398

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2011-1398
1
 
PublicDateAtUSN: 2012-08-30
2
 
Candidate: CVE-2011-1398
3
 
PublicDate: 2012-08-30
4
 
References:
5
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1398
6
 
 http://www.php.net/ChangeLog-5.php
7
 
 http://security-tracker.debian.org/tracker/CVE-2011-1398
8
 
 http://openwall.com/lists/oss-security/2012/08/29/5
9
 
 https://usn.ubuntu.com/usn/usn-1569-1
10
 
Description:
11
 
 The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x
12
 
 before 5.4.0RC2 does not check for %0D sequences (aka carriage return
13
 
 characters), which allows remote attackers to bypass an HTTP
14
 
 response-splitting protection mechanism via a crafted URL, related to
15
 
 improper interaction between the PHP header function and certain browsers,
16
 
 as demonstrated by Internet Explorer and Google Chrome.
17
 
Ubuntu-Description:
18
 
Notes:
19
 
 tyhicks> Incomplete fix is tracked as CVE-2012-4388
20
 
Bugs:
21
 
 https://bugs.php.net/bug.php?id=60227
22
 
Priority: medium
23
 
Discovered-by:
24
 
Assigned-to: mdeslaur
25
 
 
26
 
Patches_php5:
27
 
 upstream: http://svn.php.net/viewvc?view=revision&revision=318820 (trunk)
28
 
 upstream: http://svn.php.net/viewvc?view=revision&revision=318997 (5.4)
29
 
 upstream: http://git.php.net/?p=php-src.git;a=commit;h=61088ce7296f2a3b4b53e60bdf413455b870664d (5.3)
30
 
 upstream: http://svn.php.net/viewvc?view=revision&revision=323033 (trunk) (regression fix)
31
 
 upstream: http://svn.php.net/viewvc?view=revision&revision=323043 (trunk) (regression fix)
32
 
 upstream: http://svn.php.net/viewvc?view=revision&revision=323986 (5.4) (regression fix)
33
 
 upstream: http://git.php.net/?p=php-src.git;a=commit;h=8e82bda330264d290a5e55580eea2eb875d4cb69 (5.3) (regression fix)
34
 
 upstream: http://git.php.net/?p=php-src.git;a=commit;h=ca58cd01fc329f907a13b82370427715d9c5bf70 (5.3) (regression fix)
35
 
 upstream: http://git.php.net/?p=php-src.git;a=commit;h=daa190f8fd5441b077bfd5ae8e999596a8c34dd3 (5.3) (test suite fix)
36
 
upstream_php5: needs-triage
37
 
hardy_php5: released (5.2.4-2ubuntu5.26)
38
 
lucid_php5: released (5.3.2-1ubuntu4.18)
39
 
natty_php5: released (5.3.5-1ubuntu7.11)
40
 
oneiric_php5: released (5.3.6-13ubuntu3.9)
41
 
precise_php5: released (5.3.10-1ubuntu3.4)
42
 
devel_php5: not-affected (5.4.6-1ubuntu1)