PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
Configuration 9 (hide)
|
History
21 Nov 2024, 02:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html - Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2016-1609.html - Broken Link, Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2016-1610.html - Broken Link, Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2016-1611.html - Broken Link, Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2016-1612.html - Broken Link, Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2016-1613.html - Broken Link, Third Party Advisory | |
| References | () http://www.debian.org/security/2016/dsa-3631 - Third Party Advisory | |
| References | () http://www.kb.cert.org/vuls/id/797896 - Third Party Advisory, US Government Resource | |
| References | () http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - Patch, Third Party Advisory | |
| References | () http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - Patch, Third Party Advisory | |
| References | () http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/91821 - Third Party Advisory, VDB Entry | |
| References | () http://www.securitytracker.com/id/1036335 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1353794 - Issue Tracking, Third Party Advisory, VDB Entry | |
| References | () https://github.com/guzzle/guzzle/releases/tag/6.2.1 - Release Notes, Third Party Advisory | |
| References | () https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us - Third Party Advisory | |
| References | () https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 - Third Party Advisory | |
| References | () https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297 - Third Party Advisory | |
| References | () https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 - Third Party Advisory | |
| References | () https://httpoxy.org/ - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/ - | |
| References | () https://security.gentoo.org/glsa/201611-22 - Third Party Advisory | |
| References | () https://www.drupal.org/SA-CORE-2016-003 - Third Party Advisory |
29 Sep 2021, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* cpe:2.3:a:oracle:communications_user_data_repository:10.0.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_user_data_repository:12.0.0:*:*:*:*:*:*:* cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:* |
|
| References | (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1613.html - Broken Link, Third Party Advisory | |
| References | (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1611.html - Broken Link, Third Party Advisory | |
| References | (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1612.html - Broken Link, Third Party Advisory | |
| References | (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1609.html - Broken Link, Third Party Advisory | |
| References | (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1610.html - Broken Link, Third Party Advisory | |
| References | (CONFIRM) https://github.com/guzzle/guzzle/releases/tag/6.2.1 - Release Notes, Third Party Advisory |
Information
Published : 2016-07-19 02:00
Updated : 2024-11-21 02:54
NVD link : CVE-2016-5385
Mitre link : CVE-2016-5385
CVE.ORG link : CVE-2016-5385
JSON object : View
Products Affected
fedoraproject
- fedora
redhat
- enterprise_linux_desktop
- enterprise_linux_server
- enterprise_linux_workstation
oracle
- enterprise_manager_ops_center
- communications_user_data_repository
- linux
hp
- system_management_homepage
- storeever_msl6480_tape_library_firmware
- storeever_msl6480_tape_library
php
- php
opensuse
- leap
drupal
- drupal
debian
- debian_linux
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')