CVE-2016-5385
- Source
- https://cve.org/CVERecord?id=CVE-2016-5385
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5385.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2016-5385
- Aliases
- Downstream
DLA (1)
DSA (1)
openSUSE (1)
UBUNTU (1)
- Related
- Published
- 2016-07-19T02:00:17Z
- Modified
- 2026-09-25T11:45:11Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:hp:storeever_msl6480_tape_library_firmware:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "5.09" } ], "source": "CPE_RANGE", "vendor_product": "hp:storeever_msl6480_tape_library_firmware" }, { "cpes": [ "cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "7.5.5.0" } ], "source": "CPE_RANGE", "vendor_product": "hp:system_management_homepage" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "8.0" }, { "last_affected": "8.0" } ], "source": "CPE_STRING", "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "23" }, { "last_affected": "23" }, { "introduced": "24" }, { "last_affected": "24" } ], "source": "CPE_STRING", "vendor_product": "fedoraproject:fedora" }, { "cpes": [ "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "42.1" }, { "last_affected": "42.1" } ], "source": "CPE_STRING", "vendor_product": "opensuse:leap" }, { "cpes": [ "cpe:2.3:a:oracle:communications_user_data_repository:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_user_data_repository:12.0.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "10.0.0" }, { "last_affected": "10.0.0" }, { "introduced": "10.0.1" }, { "last_affected": "10.0.1" }, { "introduced": "12.0.0" }, { "last_affected": "12.0.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_user_data_repository" }, { "cpes": [ "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "12.2.2" }, { "last_affected": "12.2.2" }, { "introduced": "12.3.2" }, { "last_affected": "12.3.2" } ], "source": "CPE_STRING", "vendor_product": "oracle:enterprise_manager_ops_center" }, { "cpes": [ "cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*", "cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "6-NA" }, { "last_affected": "6-NA" }, { "introduced": "7-NA" }, { "last_affected": "7-NA" } ], "source": "CPE_STRING", "vendor_product": "oracle:linux" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "6.0" }, { "last_affected": "6.0" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_desktop" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "6.0" }, { "last_affected": "6.0" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server" }, { "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "6.0" }, { "last_affected": "6.0" } ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_workstation" } ] }- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
- http://rhn.redhat.com/errata/RHSA-2016-1609.html
- http://rhn.redhat.com/errata/RHSA-2016-1610.html
- http://rhn.redhat.com/errata/RHSA-2016-1611.html
- http://rhn.redhat.com/errata/RHSA-2016-1612.html
- http://rhn.redhat.com/errata/RHSA-2016-1613.html
- http://www.debian.org/security/2016/dsa-3631
- http://www.kb.cert.org/vuls/id/797896
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/91821
- http://www.securitytracker.com/id/1036335
- https://github.com/guzzle/guzzle/releases/tag/6.2.1
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://httpoxy.org/
- https://security.gentoo.org/glsa/201611-22
- https://www.drupal.org/SA-CORE-2016-003
- https://bugzilla.redhat.com/show_bug.cgi?id=1353794
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Affected packages
Git / github.com/drupal/drupal
Git / github.com/guzzle/guzzle
Affected versions
4.*
4.0.0
4.0.0-rc.1
4.0.0-rc.2
4.0.1
4.0.2
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0
4.2.1
4.2.2
4.2.3
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.1.0
5.2.0
5.3.0
6.*
6.0.0
6.0.1
6.0.2
6.1.0
6.1.1
6.2.0
v1.*
v1.0.0
v1.0.0beta1
v1.0.1
v1.0.2
v1.0.3
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.6.0
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1
Git / github.com/php/php-src
Affected ranges
- Type
- GIT
- Repo
- https://github.com/php/php-src
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "5.5.0" }, { "fixed": "5.5.38" }, { "introduced": "5.6.0" }, { "fixed": "5.6.24" }, { "introduced": "7.0.0" }, { "last_affected": "7.0.8" } ], "source": "CPE_RANGE" }