CVE-2006-3016
- State
- Published
- Severity
- Not scored
- Published
- Jun 14, 2006
- Updated
- Aug 7, 2024
- Reserved
- Jun 14, 2006
Description
Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://issues.rpath.com/browse/RPL-683
- RHSA-2006:0669vendor-advisory
- oval:org.mitre.oval:def:10597vdb-entrysignature
- 22487third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-221.htm
- TLSA-2006-38vendor-advisory
- 21050third-party-advisory
- 23247third-party-advisory
- 22004third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm
- RHSA-2006:0682vendor-advisory
- USN-320-1vendor-advisory
- http://www.php.net/release_5_1_3.php
- 22440third-party-advisory
- 20061005 rPSA-2006-0182-1 php php-mysql php-pgsqlmailing-list
- 22069third-party-advisory
- 22225third-party-advisory
- MDKSA-2006:122vendor-advisory
- 25253vdb-entry
- 19927third-party-advisory
- 1016306vdb-entry
- 17843vdb-entry
- RHSA-2006:0736vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.