The Suhosin Extension for PHP contains an overflow condition in the transparent cookie encryption functionality. The issue is due to the transparent cookie encryption function not properly validating user-supplied input. With specially crafted input passed to an affected script, a remote attacker can cause a stack-based buffer overflow, resulting in a denial of service or potentially execution of arbitrary code.

It has been reported that this issue has been fixed. Upgrade to version 0.9.33, or higher, to address this vulnerability.

• CVE ID: 2012-0807 (see also: NVD)
• Secunia Advisory ID: 47689 48567 48668 48726 48828
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2012-01/0296.html
  http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
  http://seclists.org/fulldisclosure/2012/Jan/295
  http://seclists.org/oss-sec/2012/q1/272
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00005.html
  https://bugzilla.redhat.com/show_bug.cgi?id=783350
  https://github.com/stefanesser/suhosin/commit/73b1968ee30f6d9d2dae497544b910e68e114bfa
  https://hermes.opensuse.org/messages/14107451
• Vendor URL: http://www.hardened-php.net/suhosin/index.html
• Other Advisory URL: http://www.openwall.com/lists/oss-security/2012/01/24/11
  http://www.openwall.com/lists/oss-security/2012/01/24/7

• Stefan Esser - SektionEins GmbH.