Fedora 23 : perl-CGI-Emulate-PSGI (2016-a29c65b00f) (httpoxy)

This updates bumps perl-CGI-Emulate-PSGI to version 0.22 which removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Fedora 24 : perl-CGI-Emulate-PSGI (2016-683d0b257b) (httpoxy)

This updates bumps perl-CGI-Emulate-PSGI to version 0.22 which removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

lighttpd httpoxy unauthenticated remote vulnerability

Lighttpd is an open source web server. A security vulnerability exists in Lighttpd httpoxy, which can be exploited by a remote attacker to launch a man-in-the-middle attack or initiate a connection to an arbitrary host on the server...

FreeBSD : lighttpd - multiple vulnerabilities (ef0033ad-5823-11e6-80cc-001517f335e2)

Lighttpd Project reports : Security fixes for Lighttpd : - security: encode quoting chars in HTML and XML - security: ensure gid != 0 if server.username is set, but not server.groupname - security: disable statcache if server.follow-symlink = 'disable' - security: httpoxy defense: do not emit...

Debian DLA-568-1 : wordpress security update (httpoxy)

Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-5387 WordPress allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via...

PHP, Python, etc. web applications break the Remote Agent vulnerability: httpoxy-vulnerability warning-the black bar safety net

This is a for PHP, Go, Python, and other languages CGI application vulnerabilities. httpoxy is a series of effects to CGI or the class CGI to run application vulnerability name. Simple to say, it is a name space conflict. RFC 3 8 7 5 （CGI）is defined from the HTTP request to the Proxy head filled...

lighttpd - multiple vulnerabilities

Lighttpd Project reports: Security fixes for Lighttpd: security: encode quoting chars in HTML and XML security: ensure gid != 0 if server.username is set, but not server.groupname security: disable statcache if server.follow-symlink = “disable” security: httpoxy defense: do not emit HTTPPROXY to...

Fedora 24 : golang (2016-ea5e284d34) (httpoxy)

Security fix for CVE-2016-5386 AKA https://httpoxy.org/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 23 : golang (2016-340e361b90) (httpoxy)

Security fix for CVE-2016-5386 AKA https://httpoxy.org/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 23 : httpd (2016-df0726ae26) (httpoxy)

Security fix for CVE-2016-5387. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

CVE-2016-1000212

Mitigation for HTTPoxy vulnerability...

UBUNTU-CVE-2016-1000212

Mitigation for HTTPoxy vulnerability...

PHP 7.0.x < 7.0.9 Multiple Vulnerabilities (httpoxy)

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.9. It is, therefore, affected by multiple vulnerabilities : - A man-in-the-middle vulnerability exists, known as 'httpoxy', due to a failure to properly resolve namespace conflicts in accordance wit...

PHP 5.5.x < 5.5.38 Multiple Vulnerabilities (httpoxy)

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.38. It is, therefore, affected by multiple vulnerabilities : - A Segfault condition occurs when accessing nvarcharmax defined columns. CVE-2015-8879 - A man-in-the-middle vulnerability exists, known...

PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.24. It is, therefore, affected by multiple vulnerabilities : - A man-in-the-middle vulnerability exists, known as 'httpoxy', due to a failure to properly resolve namespace conflicts in accordance wi...

HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)

The web application running on the remote web server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTPPROXY environment variable is set based on untrusted user data in t...

Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2016-203-02) (httpoxy)

New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-203-02. The text itself is copyright...

Debian DLA-553-1 : apache2 security update (httpoxy)

Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP...

Drupal 8.x < 8.1.7 PHP HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)

The version of Drupal running on the remote web server is 8.x prior to 8.1.7. It is, therefore, affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTPPROXY environment variable ...

Debian DSA-3623-1 : apache2 - security update (httpoxy)

Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP...