CVE-2016-5385

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-5385
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5385.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-5385
Aliases
Downstream
Related
Published
2016-07-19T02:00:17.773Z
Modified
2026-04-10T03:51:40.535731Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTPPROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

References

Affected packages

Git / github.com/drupal/drupal

Affected ranges

Type
GIT
Repo
https://github.com/drupal/drupal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2700c5afb6c3936041db413872eea82dc0bd4fe4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0faf8a707ac80ccba7768596bc3a195eb98d89fc
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/guzzle/guzzle
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
df897ae757ad329d2affc38ffb5bbce782b2b510
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
df897ae757ad329d2affc38ffb5bbce782b2b510
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
df897ae757ad329d2affc38ffb5bbce782b2b510
Fixed
3f808fba627f2c5b69e2501217bf31af349c1427
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
da35db3ec5fc4b27087292c067a6ea1d0f77bf8f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
400e65e955f08ad6ae57c1a15be04d5852107252
Introduced
2c2d0de09e522fe097bfcebfb758171eb6aa5270
Fixed
bcd100d812b525c982cf75d6c6dabe839f61634a
Introduced
fc1df8e7a6886e29a6ed5bef3f674ac61164e847
Fixed
38980c9ea4156ce52a53f9f3e1007ea3d787fa11
Introduced
60fffd296abce5fc071f3c173c25a2696cf683c6
Last affected
a36407215f69ba2debf77933dcb3faa0c3ba2d04
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5dc92c2117cafc61daaaaa240fd46c3ac33872a4
Introduced
5dc92c2117cafc61daaaaa240fd46c3ac33872a4
Fixed
d35e577a1bd0b35b9386cea97cddc73fd98eed6d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7-NA"
        },
        {
            "introduced": "5.5.0"
        },
        {
            "fixed": "5.5.38"
        },
        {
            "introduced": "5.6.0"
        },
        {
            "fixed": "5.6.24"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.0.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.1.7"
        }
    ]
}

Affected versions

1.*
1.0
10.*
10.0.0
10.0.0-alpha1
10.0.0-alpha3
10.0.0-alpha4
10.0.0-alpha5
10.0.0-alpha6
10.0.0-alpha7
10.0.0-beta1
10.0.0-beta2
10.0.0-rc1
10.0.0-rc2
10.0.0-rc3
10.0.1
2.*
2.0
3.*
3.0.1
4.*
4.0.0
4.0.0-rc.1
4.0.0-rc.2
4.0.1
4.0.2
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0
4.2.1
4.2.2
4.2.3
5.*
5.0-beta-1
5.0-beta-2
5.0-rc-1
5.0-rc-2
5.0.0
5.0.1
5.0.2
5.0.3
5.1.0
5.2.0
5.3.0
6.*
6.0-beta-1
6.0-beta-2
6.0-beta-3
6.0-beta-4
6.0-rc-1
6.0-rc-2
6.0-rc-3
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
7.*
7.0
7.0-alpha1
7.0-alpha2
7.0-alpha3
7.0-alpha4
7.0-alpha5
7.0-alpha6
7.0-alpha7
7.0-beta1
7.0-beta2
7.0-beta3
7.0-rc-1
7.0-rc-2
7.0-rc-3
7.0-rc-4
7.0-unstable-1
7.0-unstable-10
7.0-unstable-2
7.0-unstable-3
7.0-unstable-4
7.0-unstable-5
7.0-unstable-6
7.0-unstable-7
8.*
8.0-alpha10
8.0-alpha11
8.0-alpha12
8.0-alpha13
8.0-alpha2
8.0-alpha3
8.0-alpha4
8.0-alpha5
8.0-alpha6
8.0-alpha7
8.0-alpha8
8.0-alpha9
8.0.0
8.0.0-alpha14
8.0.0-alpha15
8.0.0-beta1
8.0.0-beta10
8.0.0-beta11
8.0.0-beta12
8.0.0-beta13
8.0.0-beta14
8.0.0-beta15
8.0.0-beta16
8.0.0-beta2
8.0.0-beta3
8.0.0-beta4
8.0.0-beta5
8.0.0-beta6
8.0.0-beta7
8.0.0-beta9
8.0.0-rc1
8.0.0-rc2
8.0.0-rc3
8.0.0-rc4
8.1.0-beta1
9.*
9.0.0-alpha1
9.0.0-alpha2
Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
start
php-5.*
php-5.6.24RC1
php-7.*
php-7.0.8
php-7.0.8RC1
php-8.*
php-8.0.0
php-8.1.7RC1
v1.*
v1.0.0
v1.0.0beta1
v1.0.1
v1.0.2
v1.0.3
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.6.0
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5385.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.3.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "23"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "24"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "5.09"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.5.5.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "42.1"
            }
        ]
    }
]