CVE-2016-3166

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.38

Description A CRLF injection issue exists in the drupal set header function when used with PHP before 5.1.2, allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.

Recommendations For Drupal versions 6.x before 6.38, update to version 6.38 or later to resolve the issue.