Unrated severityNVD Advisory· Published Aug 30, 2012· Updated Jun 16, 2026
CVE-2011-1398
CVE-2011-1398
Description
The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: <=5.3.10
- cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.9:*:*:*:*:*:*:*
- (no CPE)range: <5.3.11 and 5.4.x <5.4.0RC2
Patches
Vulnerability mechanics
References
10- article.gmane.org/gmane.comp.php.devel/70584nvd
- lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.htmlnvd
- openwall.com/lists/oss-security/2012/08/29/5nvd
- openwall.com/lists/oss-security/2012/09/05/15nvd
- rhn.redhat.com/errata/RHSA-2013-1307.htmlnvd
- secunia.com/advisories/55078nvd
- security-tracker.debian.org/tracker/CVE-2011-1398nvd
- www.securitytracker.com/idnvd
- www.ubuntu.com/usn/USN-1569-1nvd
- bugs.php.net/bug.phpnvd
News mentions
0No linked articles in our index yet.