CVE-2015-8935

The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without…

published August 7, 2016

CVSS
—
EPSS
3%
Percentile
87.0
In the wild
Unconfirmed
What it is

The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02959 · 87.0th percentile
Published
2016-08-07T10:00Z
EPSS history
Timeline
  • 07 AUG 10:00Z
    The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without…
    cvelistv5