CVE-2012-0807

2012-01-2700:55:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2012-0807

buffer overflow

suhosin

php

remote code execution

encryption

nvd

7.8 High

AI Score

Confidence

Low

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.045 Low

EPSS

Percentile

92.4%

JSON

Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header.

CPENameOperatorVersion
hardened-php:suhosinhardened-php suhosineq0.9.22
hardened-php:suhosinhardened-php suhosineq0.9.11
hardened-php:suhosinhardened-php suhosineq0.9.12
hardened-php:suhosinhardened-php suhosineq0.9.4
hardened-php:suhosinhardened-php suhosineq0.9.10
hardened-php:suhosinhardened-php suhosineq0.9.21
hardened-php:suhosinhardened-php suhosineq0.9.0
hardened-php:suhosinhardened-php suhosineq0.9.13
hardened-php:suhosinhardened-php suhosineq0.9.3
hardened-php:suhosinhardened-php suhosineq0.9.9

CPE	Name	Operator	Version
hardened-php:suhosin	hardened-php suhosin	eq	0.9.22
hardened-php:suhosin	hardened-php suhosin	eq	0.9.11
hardened-php:suhosin	hardened-php suhosin	eq	0.9.12
hardened-php:suhosin	hardened-php suhosin	eq	0.9.4
hardened-php:suhosin	hardened-php suhosin	eq	0.9.10
hardened-php:suhosin	hardened-php suhosin	eq	0.9.21
hardened-php:suhosin	hardened-php suhosin	eq	0.9.0
hardened-php:suhosin	hardened-php suhosin	eq	0.9.13
hardened-php:suhosin	hardened-php suhosin	eq	0.9.3
hardened-php:suhosin	hardened-php suhosin	eq	0.9.9