Skip to content
Fencer Vulns
high 8.1

CVE-2016-5385 in the critical feed json

HTTP Proxy header vulnerability

published 2016-07-19 10 y ago modified 2026-06-17 4 mo ago also GHSA-m6ch-gg5f-wxx3 , EUVD-2016-6335

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
50.4%
EPSS 50.4% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

Patch / fix

  • packagist guzzlehttp/guzzle 4.2.4, 5.3.1, 6.2.1
  • packagist drupal/core 8.1.7
  • packagist bugsnag/bugsnag-laravel 2.0.2
  • packagist amphp/artax 1.0.4, 2.0.4
  • packagist padraic/humbug_get_contents 1.1.2
  • php php 5.5.38, 5.6.24
  • drupal drupal 8.1.7
  • php5 Ubuntu 14.04 LTS 5.5.9+dfsg-1ubuntu4.19
  • php7.0 Ubuntu 16.04 LTS 7.0.8-0ubuntu0.16.04.2

ubuntu advisories UBUNTU-CVE-2016-5385

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-php56-php RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el6
  • rh-php56-php RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el7
  • rh-php56-php-gd RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el6
  • rh-php56-php-gd RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el7
  • rh-php56-php-cli RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el6
  • rh-php56-php-cli RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el7
  • rh-php56-php-dba RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el6
  • rh-php56-php-dba RHEL 2 SOFTWARE_COLLECTIONS 5.6.5-9.el7

red hat advisories RHSA-2016:1612RHSA-2016:1611RHSA-2016:1610RHSA-2016:1609RHSA-2016:1613

  • php7 SLE Software Development Kit 12 SP2, SLE Software Development Kit 12 SP1, SLE Module for Web and Scripting 12 7.0.7-25.1
  • php5 SLE Software Development Kit 12 SP1, SLE Module for Web and Scripting 12 5.5.14-68.1

suse advisories SUSE-SU-2016:2941-1SUSE-SU-2016:1842-1

  • platformsh-cli openSUSE Tumbleweed 3.67.2-1.2

opensuse advisories openSUSE-SU-2024:11175-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-5385 updated cvss 5.0

PHP: sets environmental variable based on user supplied Proxy request header

  • Red Hat Enterprise Linux 5 php, php53
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client Optional (v. 7) php 5.4.16-36.3.el7_2, php-gd 5.4.16-36.3.el7_2, php-cli 5.4.16-36.3.el7_2, php-dba 5.4.16-36.3.el7_2, php-fpm 5.4.16-36.3.el7_2, php-pdo 5.4.16-36.3.el7_2, +18 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) php 5.4.16-36.3.el7_2, php-gd 5.4.16-36.3.el7_2, php-cli 5.4.16-36.3.el7_2, php-dba 5.4.16-36.3.el7_2, php-fpm 5.4.16-36.3.el7_2, php-pdo 5.4.16-36.3.el7_2, +18 more
    fixed: vendor fix RHSA-2016:1613
  • Red Hat Enterprise Linux Desktop Optional (v. 6) php 5.3.3-48.el6_8, php-gd 5.3.3-48.el6_8, php-cli 5.3.3-48.el6_8, php-dba 5.3.3-48.el6_8, php-fpm 5.3.3-48.el6_8, php-pdo 5.3.3-48.el6_8, +20 more Red Hat Enterprise Linux HPC Node (v. 6) php 5.3.3-48.el6_8, php-cli 5.3.3-48.el6_8, php-common 5.3.3-48.el6_8 Red Hat Enterprise Linux HPC Node Optional (v. 6) php 5.3.3-48.el6_8, php-gd 5.3.3-48.el6_8, php-dba 5.3.3-48.el6_8, php-fpm 5.3.3-48.el6_8, php-pdo 5.3.3-48.el6_8, php-xml 5.3.3-48.el6_8, +18 more Red Hat Enterprise Linux Server (v. 6) php 5.3.3-48.el6_8, php-gd 5.3.3-48.el6_8, php-cli 5.3.3-48.el6_8, php-pdo 5.3.3-48.el6_8, php-xml 5.3.3-48.el6_8, php-ldap 5.3.3-48.el6_8, +6 more
    fixed: vendor fix RHSA-2016:1609
  • Red Hat Enterprise Linux Server (v. 7) php 5.4.16-36.3.el7_2, php-gd 5.4.16-36.3.el7_2, php-cli 5.4.16-36.3.el7_2, php-pdo 5.4.16-36.3.el7_2, php-xml 5.4.16-36.3.el7_2, php-ldap 5.4.16-36.3.el7_2, +8 more
    fixed: vendor fix RHSA-2016:1613
  • Red Hat Enterprise Linux Server Optional (v. 6) php-dba 5.3.3-48.el6_8, php-fpm 5.3.3-48.el6_8, php-zts 5.3.3-48.el6_8, php-imap 5.3.3-48.el6_8, php-intl 5.3.3-48.el6_8, php-snmp 5.3.3-48.el6_8, +8 more
    fixed: vendor fix RHSA-2016:1609
  • Red Hat Enterprise Linux Server Optional (v. 7) php-dba 5.4.16-36.3.el7_2, php-fpm 5.4.16-36.3.el7_2, php-intl 5.4.16-36.3.el7_2, php-snmp 5.4.16-36.3.el7_2, php-bcmath 5.4.16-36.3.el7_2, php-pspell 5.4.16-36.3.el7_2, +4 more
    fixed: vendor fix RHSA-2016:1613
  • Red Hat Enterprise Linux Workstation (v. 6) php 5.3.3-48.el6_8, php-gd 5.3.3-48.el6_8, php-cli 5.3.3-48.el6_8, php-pdo 5.3.3-48.el6_8, php-xml 5.3.3-48.el6_8, php-ldap 5.3.3-48.el6_8, +6 more
    fixed: vendor fix RHSA-2016:1609
  • Red Hat Enterprise Linux Workstation (v. 7) php 5.4.16-36.3.el7_2, php-gd 5.4.16-36.3.el7_2, php-cli 5.4.16-36.3.el7_2, php-pdo 5.4.16-36.3.el7_2, php-xml 5.4.16-36.3.el7_2, php-ldap 5.4.16-36.3.el7_2, +8 more
    fixed: vendor fix RHSA-2016:1613
show 3 more
  • Red Hat Enterprise Linux Workstation Optional (v. 6) php-dba 5.3.3-48.el6_8, php-fpm 5.3.3-48.el6_8, php-zts 5.3.3-48.el6_8, php-imap 5.3.3-48.el6_8, php-intl 5.3.3-48.el6_8, php-snmp 5.3.3-48.el6_8, +8 more
    fixed: vendor fix RHSA-2016:1609
  • Red Hat Enterprise Linux Workstation Optional (v. 7) php-dba 5.4.16-36.3.el7_2, php-fpm 5.4.16-36.3.el7_2, php-intl 5.4.16-36.3.el7_2, php-snmp 5.4.16-36.3.el7_2, php-bcmath 5.4.16-36.3.el7_2, php-pspell 5.4.16-36.3.el7_2, +4 more
    fixed: vendor fix RHSA-2016:1613
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) php54-php 5.4.40-4.el6, php55-php 5.5.21-5.el6, rh-php56-php 5.6.5-9.el6, php54-php-gd 5.4.40-4.el6, php55-php-gd 5.5.21-5.el6, php54-php-cli 5.4.40-4.el6, +72 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) php54-php 5.4.40-4.el7, php55-php 5.5.21-5.el7, rh-php56-php 5.6.5-9.el7, php54-php-gd 5.4.40-4.el7, php55-php-gd 5.5.21-5.el7, php54-php-cli 5.4.40-4.el7, +66 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) php54-php 5.4.40-4.el6, php55-php 5.5.21-5.el6, rh-php56-php 5.6.5-9.el6, php54-php-gd 5.4.40-4.el6, php55-php-gd 5.5.21-5.el6, php54-php-cli 5.4.40-4.el6, +72 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) php54-php 5.4.40-4.el6, php55-php 5.5.21-5.el6, rh-php56-php 5.6.5-9.el6, php54-php-gd 5.4.40-4.el6, php55-php-gd 5.5.21-5.el6, php54-php-cli 5.4.40-4.el6, +72 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) php54-php 5.4.40-4.el7, php55-php 5.5.21-5.el7, rh-php56-php 5.6.5-9.el7, php54-php-gd 5.4.40-4.el7, php55-php-gd 5.5.21-5.el7, php54-php-cli 5.4.40-4.el7, +66 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) php54-php 5.4.40-4.el7, php55-php 5.5.21-5.el7, rh-php56-php 5.6.5-9.el7, php54-php-gd 5.4.40-4.el7, php55-php-gd 5.5.21-5.el7, php54-php-cli 5.4.40-4.el7, +66 more
    +2 more products
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) php54-php 5.4.40-4.el6, php55-php 5.5.21-5.el6, rh-php56-php 5.6.5-9.el6, php54-php-gd 5.4.40-4.el6, php55-php-gd 5.5.21-5.el6, php54-php-cli 5.4.40-4.el6, +72 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) php54-php 5.4.40-4.el7, php55-php 5.5.21-5.el7, rh-php56-php 5.6.5-9.el7, php54-php-gd 5.4.40-4.el7, php55-php-gd 5.5.21-5.el7, php54-php-cli 5.4.40-4.el7, +66 more
    fixed: vendor fix RHSA-2016:1610

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-027-02 updated cvss 8.1

Festo Didactic SE MES PC

  • Festo Didactic SE MES PC shipped_with_Windows_10
    affected: vendor fix

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

50.43% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist guzzlehttp/guzzle
>=6, <6.2.1
>=4.0.0-rc2, <4.2.4
>=5, <5.3.1
6.2.1
4.2.4
5.3.1
packagist drupal/core
>=8.0, <8.1.7
8.1.7
packagist bugsnag/bugsnag-laravel
<2.0.2
2.0.2
packagist amphp/artax
<1.0.4
>=2.0.0, <2.0.4
1.0.4
2.0.4
packagist padraic/humbug_get_contents
<1.1.2
1.1.2

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.