Author	Note
iconstantin	Apache provided that the fix for this issue against httpd (CVE-2016-5387) also mitigates all risks for CGI’s which are invoked by mod_fcgid.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlibapache2-mod-fcgid< anyUNKNOWN
ubuntu20.04noarchlibapache2-mod-fcgid< anyUNKNOWN
ubuntu22.04noarchlibapache2-mod-fcgid< anyUNKNOWN
ubuntu23.10noarchlibapache2-mod-fcgid< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	libapache2-mod-fcgid	< any	UNKNOWN
ubuntu	20.04	noarch	libapache2-mod-fcgid	< any	UNKNOWN
ubuntu	22.04	noarch	libapache2-mod-fcgid	< any	UNKNOWN
ubuntu	23.10	noarch	libapache2-mod-fcgid	< any	UNKNOWN

References

launchpad.net/bugs/cve/CVE-2016-1000104

marc.info/?l=oss-security&m=146885145004975&w=2

nvd.nist.gov/vuln/detail/CVE-2016-1000104

security-tracker.debian.org/tracker/CVE-2016-1000104

www.apache.org/security/asf-httpoxy-response.txt

www.cve.org/CVERecord?id=CVE-2016-1000104

nessus 43

redhatcve 2

cbl_mariner 1

openvas 31

mageia 3

prion 4

cve 4

redhat 8

fedora 4

f5 2

debian 4

oraclelinux 2

httpd 2

centos 2

ibm 12

veracode 1

ubuntucve 2

debiancve 1

osv 2

ubuntu 1

amazon 1

alpinelinux 1

cloudfoundry 1

altlinux 3

slackware 1

freebsd 1

checkpoint_advisories 1

cert 1

threatpost 1

gentoo 1

impervablog 1

apple 6

oracle 2

nessus

openSUSE Security Update : apache2-mod_fcgid (openSUSE-2016-1005) (httpoxy)

2016-08-22 00:00:00

Fedora 23 : httpd (2016-df0726ae26) (httpoxy)

2016-07-28 00:00:00

Scientific Linux Security Update : httpd on SL7.x x86_64 (20160718) (httpoxy)

2016-07-19 00:00:00

redhatcve

CVE-2016-1000104

2016-07-18 14:49:14

CVE-2016-5387

2016-07-18 14:19:04

cbl_mariner

CVE-2016-1000104 affecting package mod_fcgid 2.3.9-21

2024-04-25 09:08:18

openvas

Mageia: Security Advisory (MGASA-2017-0203)

2022-01-28 00:00:00

Apache HTTP Server Man-in-the-Middle Attack Vulnerability (Jul 2016) - Linux

2016-07-26 00:00:00

Amazon Linux: Security Advisory (ALAS-2016-725)

2016-10-26 00:00:00

mageia

Updated apache-mod_fcgid packages fix security vulnerability

2017-07-13 12:10:46

Updated perl-CGI-Emulate-PSGI packages fix security vulnerability

2017-05-26 09:54:58

Updated apache packages fix security vulnerability

2016-07-27 00:16:28

prion

Security feature bypass

2019-12-03 22:15:00

Design/Logic Flaw

2016-07-19 02:00:00

Design/Logic Flaw

2016-10-06 14:59:00

cve

CVE-2016-1000104

2019-12-03 22:15:00

CVE-2016-5387

2016-07-19 02:00:00

CVE-2016-1000102

2016-10-06 14:59:00

redhat

(RHSA-2016:1851) Important: Red Hat JBoss Core Services Apache HTTP 2.4.6 Service Pack 1 security update

2016-09-12 16:50:10

(RHSA-2016:1422) Important: httpd security and bug fix update

2016-07-18 14:13:23

(RHSA-2016:1421) Important: httpd security update

2016-07-18 00:00:00

fedora

[SECURITY] Fedora 23 Update: perl-CGI-Emulate-PSGI-0.22-1.fc23

2016-08-09 00:02:40

[SECURITY] Fedora 23 Update: httpd-2.4.23-4.fc23

2016-07-27 20:56:05

[SECURITY] Fedora 24 Update: perl-CGI-Emulate-PSGI-0.22-1.fc24

2016-08-08 20:37:39

SOL80513384 - Apache HTTPD vulnerability CVE-2016-5387

2016-08-02 00:00:00

Apache HTTPD vulnerability CVE-2016-5387

2016-08-02 21:36:00

debian

[SECURITY] [DSA 3623-1] apache2 security update

2016-07-20 08:39:47

[SECURITY] [DLA 553-1] apache2 security update

2016-07-20 11:30:29

[SECURITY] [DSA 3623-1] apache2 security update

2016-07-20 08:39:47

oraclelinux

httpd security update

2016-07-18 00:00:00

httpd security and bug fix update

2016-07-18 00:00:00

httpd

Apache Httpd < 2.4.25 : HTTP_PROXY environment variable "httpoxy" mitigation

2016-07-02 00:00:00

Apache Httpd < 2.2.32 : HTTP_PROXY environment variable "httpoxy" mitigation

2016-07-02 00:00:00

centos

httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

2016-07-18 16:26:29

httpd, mod_ssl security update

2016-07-18 15:57:06

ibm

Security Bulletin: Redirect HTTP traffic vulnerability may affect IBM HTTP Server (CVE-2016-5387)

2022-09-08 00:09:56

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli Security Policy Manager (CVE-2016-5387)

2018-06-16 21:48:41

Security Bulletin: A vulnerability in the Apache HTTP Server affects PowerKVM (CVE-2016-5387)

2018-06-18 01:32:51

veracode

Open Redirection

2019-01-15 09:12:18

ubuntucve

CVE-2016-5387

2016-07-18 00:00:00

CVE-2016-4694

2016-09-25 00:00:00

debiancve

CVE-2016-5387

2016-07-19 02:00:00

osv

CVE-2016-5387

2016-07-19 02:00:00

wordpress - security update

2016-07-29 00:00:00

ubuntu

Apache HTTP Server vulnerability

2016-07-18 00:00:00

amazon

Important: httpd24, httpd

2016-07-20 18:00:00

alpinelinux

CVE-2016-5387

2016-07-19 02:00:00

cloudfoundry

Multiple CVEs: httpoxy | Cloud Foundry

2016-12-21 00:00:00

altlinux

Security fix for the ALT Linux 8 package apache2 version 1:2.4.25-alt1

2017-05-18 00:00:00

Security fix for the ALT Linux 10 package apache2 version 1:2.4.25-alt1

2017-05-18 00:00:00

Security fix for the ALT Linux 9 package apache2 version 1:2.4.25-alt1

2017-05-18 00:00:00

slackware

[slackware-security] httpd

2016-12-24 01:35:08

freebsd

Apache httpd -- several vulnerabilities

2016-12-20 00:00:00

checkpoint_advisories

CGI Namespace Conflict Man-In-The-Middle (httpoxy; CVE-2016-1000109; CVE-2016-1000110; CVE-2016-5385; CVE-2016-5386; CVE-2016-5387; CVE-2016-5388)

2016-07-19 00:00:00

cert

CGI web servers assign Proxy header values from client requests to internal HTTP_PROXY environment variables

2016-07-18 00:00:00

threatpost

CGI Script Vulnerability 'Httpoxy' Allows Man-in-the-Middle Attack

2016-07-18 18:00:46

gentoo

Apache: Multiple vulnerabilities

2017-01-15 00:00:00

impervablog

Python and Go Top the Chart of 2019’s Most Popular Hacking Tools

2020-05-27 09:22:21

apple

About the security content of macOS High Sierra 10.13

2017-09-25 00:00:00

About the security content of macOS High Sierra 10.13 - Apple Support

2020-02-06 07:51:09

About the security content of macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite - Apple Support

2017-08-29 02:52:03

oracle

Oracle Critical Patch Update - January 2018

2018-01-16 00:00:00

Oracle Critical Patch Update Advisory - July 2017

2018-03-20 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

80.9%

JSON

Related for UB:CVE-2016-1000104