Read the docs
TI-2012-00744 Aliases CVE-2012-0807GHSA-269p-6jw2-x3jp

Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the…

Priority LOW 29CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header.

Why it matters now

EPSS 0.03466 89th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:hardened-php:suhosin:*:beta_2006.09.07:*:*:*:*:*:*all versionsVulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:*:beta_2006.09.09:*:*:*:*:*:*all versionsVulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:*:*:*:*:*:*:*:*up to 0.9.31VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.0:*:*:*:*:*:*:*0.9.0VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.2:*:*:*:*:*:*:*0.9.2VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.3:*:*:*:*:*:*:*0.9.3VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.4:*:*:*:*:*:*:*0.9.4VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.5:*:*:*:*:*:*:*0.9.5VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.6:*:*:*:*:*:*:*0.9.6VulnerableHardened-php
  • cpe:2.3:a:hardened-php:suhosin:*:beta_2006.09.07:*:*:*:*:*:* Versions all versions Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:*:beta_2006.09.09:*:*:*:*:*:* Versions all versions Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:*:*:*:*:*:*:*:* Versions up to 0.9.31 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.5:*:*:*:*:*:*:* Versions 0.9.5 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·Hardened-php
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hardened-php:suhosin:0.9.6.1:*:*:*:*:*:*:*0.9.6.1VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.6.2:*:*:*:*:*:*:*0.9.6.2VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.6.3:*:*:*:*:*:*:*0.9.6.3VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.7:*:*:*:*:*:*:*0.9.7VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.8:*:*:*:*:*:*:*0.9.8VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.9:*:*:*:*:*:*:*0.9.9VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.9.1:*:*:*:*:*:*:*0.9.9.1VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.10:*:*:*:*:*:*:*0.9.10VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.11:*:*:*:*:*:*:*0.9.11VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.12:*:*:*:*:*:*:*0.9.12VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.13:*:*:*:*:*:*:*0.9.13VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.14:*:*:*:*:*:*:*0.9.14VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.15:*:*:*:*:*:*:*0.9.15VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.16:*:*:*:*:*:*:*0.9.16VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.17:*:*:*:*:*:*:*0.9.17VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.18:*:*:*:*:*:*:*0.9.18VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.19:*:*:*:*:*:*:*0.9.19VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.20:*:*:*:*:*:*:*0.9.20VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.21:*:*:*:*:*:*:*0.9.21VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.22:*:*:*:*:*:*:*0.9.22VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.23:*:*:*:*:*:*:*0.9.23VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.24:*:*:*:*:*:*:*0.9.24VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.25:*:*:*:*:*:*:*0.9.25VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.26:*:*:*:*:*:*:*0.9.26VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.27:*:*:*:*:*:*:*0.9.27VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.28:*:*:*:*:*:*:*0.9.28VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.29:*:*:*:*:*:*:*0.9.29VulnerableHardened-php
cpe:2.3:a:hardened-php:suhosin:0.9.30:*:*:*:*:*:*:*0.9.30VulnerableHardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.6.1:*:*:*:*:*:*:* Versions 0.9.6.1 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.6.2:*:*:*:*:*:*:* Versions 0.9.6.2 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.6.3:*:*:*:*:*:*:* Versions 0.9.6.3 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.7:*:*:*:*:*:*:* Versions 0.9.7 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.9.1:*:*:*:*:*:*:* Versions 0.9.9.1 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.10:*:*:*:*:*:*:* Versions 0.9.10 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.11:*:*:*:*:*:*:* Versions 0.9.11 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.12:*:*:*:*:*:*:* Versions 0.9.12 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.13:*:*:*:*:*:*:* Versions 0.9.13 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.14:*:*:*:*:*:*:* Versions 0.9.14 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.15:*:*:*:*:*:*:* Versions 0.9.15 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.16:*:*:*:*:*:*:* Versions 0.9.16 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.17:*:*:*:*:*:*:* Versions 0.9.17 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.18:*:*:*:*:*:*:* Versions 0.9.18 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.19:*:*:*:*:*:*:* Versions 0.9.19 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.20:*:*:*:*:*:*:* Versions 0.9.20 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.21:*:*:*:*:*:*:* Versions 0.9.21 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.22:*:*:*:*:*:*:* Versions 0.9.22 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.23:*:*:*:*:*:*:* Versions 0.9.23 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.24:*:*:*:*:*:*:* Versions 0.9.24 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.25:*:*:*:*:*:*:* Versions 0.9.25 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.26:*:*:*:*:*:*:* Versions 0.9.26 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.27:*:*:*:*:*:*:* Versions 0.9.27 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.28:*:*:*:*:*:*:* Versions 0.9.28 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.29:*:*:*:*:*:*:* Versions 0.9.29 Vulnerable ·Hardened-php
  • cpe:2.3:a:hardened-php:suhosin:0.9.30:*:*:*:*:*:*:* Versions 0.9.30 Vulnerable ·Hardened-php

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-0807
  2. 2026-10-03 Alias added: GHSA-269p-6jw2-x3jp

References

Exploit 2

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences