DescriptionThe session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1444-1, DSA-1578-1, DTSA-61-1
Debian Bugs441433

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


this does not affect default installs, only those who have written
custom session handlers (which isn't *that* uncommon though), and
also may not work if other cookie values are set.
fix sneaked into php 5.2.3 sans-mention:
fixed in php4/etch, php5/etch, php4/sarge svn

Search for package or bug name: Reporting problems