blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2016-5385

HIGH 8.1 CVSS 3.1
Published
July 19, 2016
Last modified
June 17, 2026
NVD status
Modified
Reported by
secalert@redhat.com
Weakness
CWE-601
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

Affected products and versions

  • PHP — From 5.5.0 (including) to 5.5.38 (excluding)
  • PHP — From 5.6.0 (including) to 5.6.24 (excluding)
  • PHP — From 7.0.0 (including) to 7.0.8 (including)

References

  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-1609.html Broken Link, Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-1610.html Broken Link, Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-1611.html Broken Link, Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-1612.html Broken Link, Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-1613.html Broken Link, Third Party Advisory
  • www.debian.org http://www.debian.org/security/2016/dsa-3631 Third Party Advisory
  • www.kb.cert.org http://www.kb.cert.org/vuls/id/797896 Third Party Advisory, US Government Resource
  • www.oracle.com http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch, Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch, Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html Third Party Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/91821 Third Party Advisory, VDB Entry
  • www.securitytracker.com http://www.securitytracker.com/id/1036335 Third Party Advisory, VDB Entry
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1353794 Issue Tracking, Third Party Advisory, VDB Entry
  • github.com https://github.com/guzzle/guzzle/releases/tag/6.2.1 Release Notes, Third Party Advisory
  • h20566.www2.hpe.com https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us Third Party Advisory
  • h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 Third Party Advisory
  • h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297 Third Party Advisory
  • h20566.www2.hpe.com https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 Third Party Advisory
  • httpoxy.org https://httpoxy.org/ Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/
  • security.gentoo.org https://security.gentoo.org/glsa/201611-22 Third Party Advisory
  • www.drupal.org https://www.drupal.org/SA-CORE-2016-003 Third Party Advisory
  • nvd.nist.gov Official NVD record