CVE-2016-5385

Scores

EPSS

0.000none0.0%
0%20%40%60%80%100%

Percentile: 0.0%

CVSS

8.1high3.x
0246810

CVSS Score: 8.1/10

All CVSS Scores

CVSS 3.x
8.1

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0
5.1

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application’s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv(‘HTTP_PROXY’) call or (2) a CGI configuration of PHP, aka an “httpoxy” issue.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdubuntu

CWEs

CWE-601

Recommendations

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

URL: http://rhn.redhat.com/errata/RHSA-2016-1613.html

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

URL: http://rhn.redhat.com/errata/RHSA-2016-1612.html

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

URL: http://rhn.redhat.com/errata/RHSA-2016-1611.html

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

URL: http://rhn.redhat.com/errata/RHSA-2016-1610.html

Source: nvd

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

URL: http://rhn.redhat.com/errata/RHSA-2016-1609.html

Vulnerable Software (18)

Type: Configuration

Product: php5

Operating System: ubuntu trusty 14.04

Trait:
{  "fixed": "5.5.9+dfsg-1ubuntu4.19"}

Source: ubuntu

Type: Configuration

Product: php5

Operating System: ubuntu wily 15.10

Trait:
{  "unfixed": true}

Source: ubuntu

Type: Configuration

Product: php5

Operating System: debian

Trait:
{  "fixed": "5.6.24+dfsg-1"}

Source: debian

Type: Configuration

Product: php7.0

Operating System: ubuntu xenial 16.04

Trait:
{  "fixed": "7.0.8-0ubuntu0.16.04.2"}

Source: ubuntu

Type: Configuration

Product: php7.0

Operating System: debian

Trait:
{  "fixed": "7.0.9-1"}

Source: debian

Type: Configuration

Vendor: debian

Product: debian_linux

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd

Type: Configuration

Vendor: drupal

Product: drupal

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",      "versionEndExcluding": "8.1.7",      "versionStartIncluding": "8.0.0",      "vulnerable": true    }  ],...

Source: nvd

Type: Configuration

Vendor: fedoraproject

Product: fedora

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*",...

Source: nvd

Type: Configuration

Vendor: hp

Product: storeever_msl6480_tape_library_firmware

Operating System: * * *

Trait:
{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:o:hp:storeever_msl6480_tape_library_firmware:*:*:*:*:*:*:*:*",          "versionEndIncluding": "5.09",          ...

Source: nvd

Type: Configuration

Vendor: hp

Product: system_management_homepage

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*",      "versionEndIncluding": "7.5.5.0",      "vulnerable": true    }  ],  "operator": "OR"}

Source: nvd