vrana: I think this is a pretty bad security issue. Here is a proposed diff as a 
github gist: https://gist.github.com/1675788

Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions.  Due to the volume
of reports we can not explain in detail here why your report is not
a bug.  The support channels will be able to provide an explanation
for you.

Thank you for your interest in PHP.

It is up-to the developer to ensure that input supplied by the user is properly 
validated before being transmitted back to the user or external services. In this 
particular case the issue is input validation. You can do the same operation with 
any stream operation by feeding it user data.

For example:

$fp = fsockopen(web_server, 80);
fwrite($fp, $user_input);
...

I'm disagree with "Not a bug". What kind of value we pass to 'user_agent' ini option?

>
> Define the user agent for PHP to send.
>

Nothing said. In fact, we pass piece of whole block of headers, not just a value.

RFC2616 says:

    User-Agent      = "User-Agent" ":" 1*( product | comment )
    product         = token ["/" product-version]
    product-version = token
    token           = 1*<any CHAR except CTLs or separators>
    separators      = "(" | ")" | "<" | ">" | "@"
                    | "," | ";" | ":" | "\" | <">
                    | "/" | "[" | "]" | "?" | "="
                    | "{" | "}" | SP | HT

    comment        = "(" *( ctext | quoted-pair | comment ) ")"
    ctext          = <any TEXT excluding "(" and ")">
    quoted-pair    = "\" CHAR

    TEXT           = <any OCTET except CTLs,
                     but including LWS>

    LWS            = [CRLF] 1*( SP | HT )

    OCTET          = <any 8-bit sequence of data>
    CHAR           = <any US-ASCII character (octets 0 - 127)>
    CTL            = <any US-ASCII control character
                     (octets 0 - 31) and DEL (127)>

Ok, looks like end programmer should to pass correct value. But only VALUE, not piece of headers. Yes, problem goes from end programmer, who pass wrong things to 'user_agent', who doesn't know about RFC2616.

CRLF can be found in User-Agent definition only inside `ctext` and only as LWS. So, PHP can check, if 'user_agent' has CRLF without SPACE or TAB after it. PHP doesn't need to check it on every run. One check per run just before first use of 'user_agent' and when changing it with ini_set() is enough to throw a Notice, a Warning or do something else to say end programmer, that he is not right. PHP can even insert SPACE after CRLF in that case and use new value instead of incorrect value.