Description:
------------
the php function setcookie (ext/standar/head.c) is vulnerable to XSS issue, when parameters passed to setcookie comes from $_REQUEST, an attacker can produce a crash in php, and execute html/javascript code in the context of the vulnerable site.

The example provided produce a Warning in php, and in the content of the warning html code is interpreted by the browser.

Reproduce code:
---------------
<?php

setcookie("\n<h1>XSS'ED!</h1>","bug in setcookie function");

?>


Expected result:
----------------
the warning message should be parsed to clean html code, like all warnings in php, for security reasons

Actual result:
--------------
crash with html code executed.