CVE-2012-4388

The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0
does not properly determine a pointer during checks for %0D sequences (aka
carriage return characters), which allows remote attackers to bypass an
HTTP response-splitting protection mechanism via a crafted URL, related to
improper interaction between the PHP header function and certain browsers,
as demonstrated by Internet Explorer and Google Chrome. NOTE: this
vulnerability exists because of an incorrect fix for CVE-2011-1398.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4388&gt;

Notes