Your submission was sent successfully! Close

CVE-2016-3166

Published: 12 April 2016

CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.

Priority

Unknown

CVSS 3 base score: 5.9

Status

Package Release Status
drupal6
Launchpad, Ubuntu, Debian
precise Not vulnerable
(requires php older than 5.1.2)
trusty Does not exist

upstream
Released (6.38)
wily Does not exist

drupal7
Launchpad, Ubuntu, Debian
precise Not vulnerable

trusty Does not exist
(trusty was not-affected)
upstream Not vulnerable

wily Not vulnerable