Wind River Support Network

HomeDefectsLIN6-11622
Fixed

LIN6-11622 : Security Advisory - php - CVE-2016-5385

Created: Jul 27, 2016    Updated: Dec 3, 2018
Resolved Date: Aug 14, 2016
Found In Version: 6.0.0.30
Fix Version: 6.0.0.31
Severity: Standard
Applicable for: Wind River Linux 6
Component/s: Userspace

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an httpoxy issue.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5385

Other Downloads


Live chat
Online