NetSight
IP …
high8.1

CVE-2016-5385

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untr…

Impact

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

Affected products

VendorProductAffected versions
OracleCommunications User Data Repository
Versions 10.0.0, 10.0.1, 12.0.0
OracleEnterprise Manager Ops Center
Versions 12.2.2, 12.3.2
OracleLinux
Versions 6, 7
FedoraprojectFedora
Versions 23, 24
HpStoreever Msl6480 Tape Library Firmware
through 5.09
HpSystem Management Homepage
through 7.5.5.0
PhpPhp
from 5.5.0 before 5.5.38
from 5.6.0 before 5.6.24
from 7.0.0 through 7.0.8
RedhatEnterprise Linux Desktop
Version 6.0
RedhatEnterprise Linux Server
Version 6.0
RedhatEnterprise Linux Workstation
Version 6.0
DebianDebian Linux
Version 8.0
OpensuseLeap
Version 42.1

Weakness classification

CWE-601

References