Описание
ELSA-2016-1613: php security and bug fix update (MODERATE)
[5.4.16-36.3]
- don't set environmental variable based on user supplied Proxy request header CVE-2016-5385
[5.4.16-36.2]
- fix segmentation fault in header_register_callback #1346758
Обновленные пакеты
Oracle Linux 7
Oracle Linux x86_64
php
5.4.16-36.3.el7_2
php-bcmath
5.4.16-36.3.el7_2
php-cli
5.4.16-36.3.el7_2
php-common
5.4.16-36.3.el7_2
php-dba
5.4.16-36.3.el7_2
php-devel
5.4.16-36.3.el7_2
php-embedded
5.4.16-36.3.el7_2
php-enchant
5.4.16-36.3.el7_2
php-fpm
5.4.16-36.3.el7_2
php-gd
5.4.16-36.3.el7_2
php-intl
5.4.16-36.3.el7_2
php-ldap
5.4.16-36.3.el7_2
php-mbstring
5.4.16-36.3.el7_2
php-mysql
5.4.16-36.3.el7_2
php-mysqlnd
5.4.16-36.3.el7_2
php-odbc
5.4.16-36.3.el7_2
php-pdo
5.4.16-36.3.el7_2
php-pgsql
5.4.16-36.3.el7_2
php-process
5.4.16-36.3.el7_2
php-pspell
5.4.16-36.3.el7_2
php-recode
5.4.16-36.3.el7_2
php-snmp
5.4.16-36.3.el7_2
php-soap
5.4.16-36.3.el7_2
php-xml
5.4.16-36.3.el7_2
php-xmlrpc
5.4.16-36.3.el7_2
Связанные CVE
Связанные уязвимости
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 ...