ELSA-2016-1609

Опубликовано: 11 авг. 2016

Источник: oracle-oval

Платформа: Oracle Linux 6

Описание

ELSA-2016-1609: php security update (MODERATE)

[5.3.3-48]

don't set environmental variable based on user supplied Proxy request header CVE-2016-5385

Обновленные пакеты

Oracle Linux 6

Oracle Linux x86_64

php

5.3.3-48.el6_8

php-bcmath

5.3.3-48.el6_8

php-cli

5.3.3-48.el6_8

php-common

5.3.3-48.el6_8

php-dba

5.3.3-48.el6_8

php-devel

5.3.3-48.el6_8

php-embedded

5.3.3-48.el6_8

php-enchant

5.3.3-48.el6_8

php-fpm

5.3.3-48.el6_8

php-gd

5.3.3-48.el6_8

php-imap

5.3.3-48.el6_8

php-intl

5.3.3-48.el6_8

php-ldap

5.3.3-48.el6_8

php-mbstring

5.3.3-48.el6_8

php-mysql

5.3.3-48.el6_8

php-odbc

5.3.3-48.el6_8

php-pdo

5.3.3-48.el6_8

php-pgsql

5.3.3-48.el6_8

php-process

5.3.3-48.el6_8

php-pspell

5.3.3-48.el6_8

php-recode

5.3.3-48.el6_8

php-snmp

5.3.3-48.el6_8

php-soap

5.3.3-48.el6_8

php-tidy

5.3.3-48.el6_8

php-xml

5.3.3-48.el6_8

php-xmlrpc

5.3.3-48.el6_8

php-zts

5.3.3-48.el6_8

Oracle Linux i686

php

5.3.3-48.el6_8

php-bcmath

5.3.3-48.el6_8

php-cli

5.3.3-48.el6_8

php-common

5.3.3-48.el6_8

php-dba

5.3.3-48.el6_8

php-devel

5.3.3-48.el6_8

php-embedded

5.3.3-48.el6_8

php-enchant

5.3.3-48.el6_8

php-fpm

5.3.3-48.el6_8

php-gd

5.3.3-48.el6_8

php-imap

5.3.3-48.el6_8

php-intl

5.3.3-48.el6_8

php-ldap

5.3.3-48.el6_8

php-mbstring

5.3.3-48.el6_8

php-mysql

5.3.3-48.el6_8

php-odbc

5.3.3-48.el6_8

php-pdo

5.3.3-48.el6_8

php-pgsql

5.3.3-48.el6_8

php-process

5.3.3-48.el6_8

php-pspell

5.3.3-48.el6_8

php-recode

5.3.3-48.el6_8

php-snmp

5.3.3-48.el6_8

php-soap

5.3.3-48.el6_8

php-tidy

5.3.3-48.el6_8

php-xml

5.3.3-48.el6_8

php-xmlrpc

5.3.3-48.el6_8

php-zts

5.3.3-48.el6_8

Oracle Linux sparc64

php

5.3.3-48.el6_8

php-bcmath

5.3.3-48.el6_8

php-cli

5.3.3-48.el6_8

php-common

5.3.3-48.el6_8

php-dba

5.3.3-48.el6_8

php-devel

5.3.3-48.el6_8

php-embedded

5.3.3-48.el6_8

php-enchant

5.3.3-48.el6_8

php-fpm

5.3.3-48.el6_8

php-gd

5.3.3-48.el6_8

php-imap

5.3.3-48.el6_8

php-intl

5.3.3-48.el6_8

php-ldap

5.3.3-48.el6_8

php-mbstring

5.3.3-48.el6_8

php-mysql

5.3.3-48.el6_8

php-odbc

5.3.3-48.el6_8

php-pdo

5.3.3-48.el6_8

php-pgsql

5.3.3-48.el6_8

php-process

5.3.3-48.el6_8

php-pspell

5.3.3-48.el6_8

php-recode

5.3.3-48.el6_8

php-snmp

5.3.3-48.el6_8

php-soap

5.3.3-48.el6_8

php-tidy

5.3.3-48.el6_8

php-xml

5.3.3-48.el6_8

php-xmlrpc

5.3.3-48.el6_8

php-zts

5.3.3-48.el6_8

Связанные CVE

CVE-2016-5385

Ссылки на источники

Связанные уязвимости

CVE-2016-5385

CVSS3: 8.1

ubuntu

почти 9 лет назад

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.