Description
Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.18 | RHSA-2006:0669 |
| RHEL 3 | php +6 | 4.3.2-36.ent | RHSA-2006:0669 |
Advisories 1
- RHSA-2006:0669 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://issues.rpath.com/browse/RPL-683
- RHSA-2006:0669 vendor-advisory
- oval:org.mitre.oval:def:10597 vdb-entry signature
- 22487 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-221.htm
- TLSA-2006-38 vendor-advisory
- 21050 third-party-advisory
- 23247 third-party-advisory
- 22004 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm
- RHSA-2006:0682 vendor-advisory
- USN-320-1 vendor-advisory
- http://www.php.net/release_5_1_3.php
- 22440 third-party-advisory
- 20061005 rPSA-2006-0182-1 php php-mysql php-pgsql mailing-list
- 22069 third-party-advisory
- 22225 third-party-advisory
- MDKSA-2006:122 vendor-advisory
- 25253 vdb-entry
- 19927 third-party-advisory
- 1016306 vdb-entry
- 17843 vdb-entry
- RHSA-2006:0736 vendor-advisory