VulnerabilityModified

CVE-2016-5385

HIGH 8.1EPSS 50.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 50.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 50.43% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-601
Affected: oracle/communications user data repository · oracle/enterprise manager ops center · oracle/linux · fedoraproject/fedora · hp/storeever msl6480 tape library firmware · hp/system management homepage · php/php · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation · debian/debian linux · opensuse/leap · drupal/drupal
Source: secalert@redhat.com

References

http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1609.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1610.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1611.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1612.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1613.htmlBroken Link, Third Party Advisory
http://www.debian.org/security/2016/dsa-3631Third Party Advisory
http://www.kb.cert.org/vuls/id/797896Third Party Advisory, US Government Resource
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
http://www.securityfocus.com/bid/91821Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036335Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1353794Issue Tracking, Third Party Advisory, VDB Entry
https://github.com/guzzle/guzzle/releases/tag/6.2.1Release Notes, Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_usThird Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722Third Party Advisory
https://httpoxy.org/Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/
https://security.gentoo.org/glsa/201611-22Third Party Advisory
https://www.drupal.org/SA-CORE-2016-003Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1609.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1610.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1611.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1612.htmlBroken Link, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.