Lucene search
RedHatRHSA-2016:1611HistoryAug 11, 2016 - 7:52 p.m.
(RHSA-2016:1611) Moderate: php55-php security update
2016-08-1119:52:52
access.redhat.com
40
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5.1 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
0.951 High
EPSS
Percentile
99.1%
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
- It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5385)
Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 6 | x86_64 | php55-php-bcmath | < 5.5.21-5.el6 | php55-php-bcmath-5.5.21-5.el6.x86_64.rpm |
| RedHat | 6 | x86_64 | php55-php-xml | < 5.5.21-5.el6 | php55-php-xml-5.5.21-5.el6.x86_64.rpm |
| RedHat | 7 | x86_64 | php55-php-pgsql | < 5.5.21-5.el7 | php55-php-pgsql-5.5.21-5.el7.x86_64.rpm |
| RedHat | 7 | x86_64 | php55-php-xmlrpc | < 5.5.21-5.el7 | php55-php-xmlrpc-5.5.21-5.el7.x86_64.rpm |
| RedHat | 6 | x86_64 | php55-php-opcache | < 5.5.21-5.el6 | php55-php-opcache-5.5.21-5.el6.x86_64.rpm |
| RedHat | 6 | x86_64 | php55-php-debuginfo | < 5.5.21-5.el6 | php55-php-debuginfo-5.5.21-5.el6.x86_64.rpm |
| RedHat | 6 | x86_64 | php55-php-xmlrpc | < 5.5.21-5.el6 | php55-php-xmlrpc-5.5.21-5.el6.x86_64.rpm |
| RedHat | 7 | x86_64 | php55-php-ldap | < 5.5.21-5.el7 | php55-php-ldap-5.5.21-5.el7.x86_64.rpm |
| RedHat | 6 | x86_64 | php55-php-process | < 5.5.21-5.el6 | php55-php-process-5.5.21-5.el6.x86_64.rpm |
| RedHat | 7 | x86_64 | php55-php-xml | < 5.5.21-5.el7 | php55-php-xml-5.5.21-5.el7.x86_64.rpm |
Related
redhatcve
redhatcve
CVE-2016-5385
2016-07-18 14:19:09
nessus
nessus
RHEL 7 : php (RHSA-2016:1613) (httpoxy)
2016-08-12 00:00:00
Fedora 24 : php-guzzlehttp-guzzle (2016-aef8a45afe) (httpoxy)
2016-07-29 00:00:00
CentOS 6 : php (CESA-2016:1609) (httpoxy)
2016-08-12 00:00:00
friendsofphp
friendsofphp
HTTP Proxy header vulnerability
2018-02-12 19:47:17
HTTP Proxy header vulnerability
2016-07-18 20:27:36
fedora
fedora
[SECURITY] Fedora 23 Update: php-guzzlehttp-guzzle6-6.2.1-1.fc23
2016-07-29 02:55:08
[SECURITY] Fedora 23 Update: php-guzzlehttp-guzzle-5.3.1-1.fc23
2016-07-29 02:55:03
[SECURITY] Fedora 24 Update: php-guzzlehttp-guzzle6-6.2.1-1.fc24
2016-07-29 00:00:06
oraclelinux
oraclelinux
php security update
2016-08-11 00:00:00
php security and bug fix update
2016-08-11 00:00:00
php security and bug fix update
2016-11-09 00:00:00
github
github
HTTP Proxy header vulnerability
2022-04-07 13:59:22
openvas
openvas
Fedora Update for php FEDORA-2016-8eb11666aa
2016-08-04 00:00:00
RedHat Update for php RHSA-2016:1613-01
2016-08-12 00:00:00
RedHat Update for php RHSA-2016:1609-01
2016-08-12 00:00:00
typo3
typo3
Environment Variable Injection in extension "AWS SDK for PHP" (aws_sdk_php)
2018-08-09 00:00:00
Environment Variable Injection
2016-07-19 00:00:00
prion
prion
Design/Logic Flaw
2016-07-19 02:00:00
Design/Logic Flaw
2016-10-06 14:59:00
centos
centos
php security update
2016-08-12 11:27:56
php security update
2016-08-11 21:20:11
debiancve
debiancve
CVE-2016-5385
2016-07-19 02:00:00
redhat
redhat
(RHSA-2016:1612) Moderate: rh-php56-php security update
2016-08-11 19:53:18
(RHSA-2016:1609) Moderate: php security update
2016-08-11 19:51:34
(RHSA-2016:1613) Moderate: php security and bug fix update
2016-08-11 20:10:37
f5
f5
K73071205 : PHP vulnerability CVE-2016-5385
2016-07-26 00:00:00
cve
cve
CVE-2016-5385
2016-07-19 02:00:00
CVE-2016-1000100
2016-10-06 14:59:00
archlinux
archlinux
drupal: proxy injection
2016-07-21 00:00:00
ubuntucve
ubuntucve
CVE-2016-5385
2016-07-18 00:00:00
ibm
ibm
veracode
veracode
Open Redirection
2019-01-15 09:12:46
gitlab
gitlab
HTTP Proxy header vulnerability
2016-07-18 00:00:00
osv
osv
HTTP Proxy header vulnerability
2022-04-07 13:59:22
php5 - security update
2016-12-16 00:00:00
slackware
slackware
[slackware-security] php
2016-07-21 23:38:17
cloudfoundry
cloudfoundry
Multiple CVEs: httpoxy | Cloud Foundry
2016-12-21 00:00:00
USN-3045-1 PHP vulnerabilities | Cloud Foundry
2016-09-09 00:00:00
checkpoint_advisories
checkpoint_advisories
cert
cert
threatpost
threatpost
CGI Script Vulnerability 'Httpoxy' Allows Man-in-the-Middle Attack
2016-07-18 18:00:46
impervablog
impervablog
Python and Go Top the Chart of 2019’s Most Popular Hacking Tools
2020-05-27 09:22:21
amazon
amazon
Medium: php55, php56
2016-08-01 13:30:00
debian
debian
[SECURITY] [DSA 3631-1] php5 security update
2016-07-26 20:46:29
[SECURITY] [DLA 749-1] php5 security update
2016-12-16 21:48:18
freebsd
freebsd
php -- multiple vulnerabilities
2016-07-21 00:00:00
ubuntu
ubuntu
PHP vulnerabilities
2016-08-02 00:00:00
gentoo
gentoo
PHP: Multiple vulnerabilities
2016-11-30 00:00:00
kitploit
kitploit
rosalinux
rosalinux
Advisory ROSA-SA-2021-1950
2021-07-02 17:57:45
oracle
oracle
Oracle Critical Patch Update - January 2018
2018-01-16 00:00:00
Oracle Critical Patch Update Advisory - July 2017
2018-03-20 00:00:00
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5.1 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:P/I:P/A:P
0.951 High
EPSS
Percentile
99.1%
Related for RHSA-2016:1611