does http only cookie secures the user session?
Yes, that's the whole idea behind httpOnly.
But as you already mentioned, there may be other vulnerabilities which disclose the cookie. This may happen via vulnerabilities in the server (CVE-2012-0053 which you alluded to), via server misconfiguration (TRACE, although modern browsers do not support it), or via issues in the application itself (the session cookie may be exposed in debug functionality or in the admin backend; an example would be a call to phpinfo in PHP).
It should be noted that httpOnly only mitigates XSS slightly, and that there are various other attack scenarios with XSS that are (almost) as bad as stealing the session (such as CSRF - eg to add new admin users - , phishing, keylogging, reading out secret information, etc).