CVE-2016-5385
19.07.2016, 02:00
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.| Vendor | Product | Version |
|---|---|---|
| oracle | communications_user_data_repository | 10.0.0 |
| oracle | communications_user_data_repository | 10.0.1 |
| oracle | communications_user_data_repository | 12.0.0 |
| oracle | enterprise_manager_ops_center | 12.2.2 |
| oracle | enterprise_manager_ops_center | 12.3.2 |
| hp | storeever_msl6480_tape_library_firmware | 𝑥 ≤ 5.09 |
| hp | system_management_homepage | 𝑥 ≤ 7.5.5.0 |
| php | php | 5.5.0 ≤ 𝑥 < 5.5.38 |
| php | php | 5.6.0 ≤ 𝑥 < 5.6.24 |
| php | php | 7.0.0 ≤ 𝑥 ≤ 7.0.8 |
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_workstation | 6.0 |
| debian | debian_linux | 8.0 |
| opensuse | leap | 42.1 |
| drupal | drupal | 8.0.0 ≤ 𝑥 < 8.1.7 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
References