CVE-2016-5385
published 2016-07-19CVE-2016-5385: PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of…
PriorityP261high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
50.43%
98.8th percentile
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| amphp | artax | >= 0 < 1.0.4 | 1.0.4 |
| amphp | artax | >= 2.0.0 < 2.0.4 | 2.0.4 |
| bugsnag | bugsnag-laravel | >= 0 < 2.0.2 | 2.0.2 |
| debian | debian_linux | — | — |
| drupal | core | >= 8.0 < 8.1.7 | 8.1.7 |
| drupal | drupal | >= 8.0.0 < 8.1.7 | 8.1.7 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| guzzlehttp | guzzle | >= 4.0.0-rc2 < 4.2.4 | 4.2.4 |
| guzzlehttp | guzzle | >= 5 < 5.3.1 | 5.3.1 |
| guzzlehttp | guzzle | >= 6 < 6.2.1 | 6.2.1 |
| hp | storeever_msl6480_tape_library_firmware | <= 5.09 | — |
| hp | system_management_homepage | <= 7.5.5.0 | — |
| opensuse | leap | — | — |
| oracle | communications_user_data_repository | — | — |
| oracle | communications_user_data_repository | — | — |
| oracle | communications_user_data_repository | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
| padraic | humbug_get_contents | >= 0 < 1.1.2 | 1.1.2 |
| php | php | >= 5.5.0 < 5.5.38 | 5.5.38 |
| php | php | >= 5.6.0 < 5.6.24 | 5.6.24 |
| php | php | 7.0.0 – 7.0.8 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests containing a 'Proxy' header, which PHP CGI maps to the HTTP_PROXY environment variable and may redirect outbound traffic to an attacker-controlled proxy. ↗
- →In CGI deployments, the attacker-supplied Proxy header value enters the process environment and propagates to subprocesses via system()/exec(); monitor for unexpected HTTP_PROXY values in CGI process environments. ↗
- →Under mod_php, the attack surface is limited: HTTP_PROXY enters $_SERVER but not $_ENV and does not leak to subprocesses; however getenv('HTTP_PROXY') or getenv('http_proxy') still returns the attacker-supplied value and may affect HTTP client libraries such as Guzzle. ↗
- →Review PHP applications using the Guzzle HTTP client for exploitation; Guzzle reads HTTP_PROXY via getenv() and is a known affected library under the mod_php use case. ↗
- →Patch reference: apply upstream PHP commit 98b9dfaec95e6f910f125ed172cdbd25abd006ec to remediate the HTTP_PROXY namespace conflict. ↗
- ·Under the most common Apache + mod_php deployment, HTTP_PROXY does not enter $_ENV and does not leak to subprocesses, making this vector less likely to be exploitable compared to CGI configurations. ↗
- ·PHP's getenv() case-sensitivity differs by SAPI: it is case-insensitive under mod_php (apache2handler) but case-sensitive under CGI (cgi-fcgi), affecting which call patterns are exploitable. ↗
- ·In CGI mode, libcurl (used by PHP's built-in curl functions) only honours the lowercase http_proxy environment variable, not HTTP_PROXY, limiting one specific sub-vector. ↗
- ·Red Hat Enterprise Linux 5 packages (php and php53) are marked 'Will not fix', meaning patched packages will not be provided for that platform. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Festo Didactic SE MES PC
cisa_ics·2026-01-27·CVSS 7.5
[HIGH] Festo Didactic SE MES PC
ICS Advisory
##
Festo Didactic SE MES PC
Release DateJanuary 27, 2026
Alert CodeICSA-26-027-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.
The
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2016-08-02·CVSS 9.8
CVE-2015-4116 [CRITICAL] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled certain SplMinHeap::compare
operations. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)
It was discovered that PHP incorrectly handled recursive method calls. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu
14.04 LTS. (CVE-2015-8873)
It was discovered that PHP incorrectly validated certain Exception objects
when unserializing data. A remote attacker could use this issue to cause
PHP to crash, resulting
Red Hat
PHP: sets environmental variable based on user supplied Proxy request header
vendor_redhat·2016-07-18·CVSS 8.1
CVE-2016-5385 [HIGH] CWE-20 PHP: sets environmental variable based on user supplied Proxy request header
PHP: sets environmental variable based on user supplied Proxy request header
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attac
OSV
HTTP Proxy header vulnerability
osv·2022-04-07
CVE-2016-5385 [HIGH] HTTP Proxy header vulnerability
HTTP Proxy header vulnerability
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
OSV
php5, php7.0 vulnerabilities
osv·2016-08-02·CVSS 9.8
CVE-2015-4116 [CRITICAL] php5, php7.0 vulnerabilities
php5, php7.0 vulnerabilities
It was discovered that PHP incorrectly handled certain SplMinHeap::compare
operations. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)
It was discovered that PHP incorrectly handled recursive method calls. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu
14.04 LTS. (CVE-2015-8873)
It was discovered that PHP incorrectly validated certain Exception objects
when unserializing data. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitr
OSV
CVE-2016-5385: PHP through 7
osv·2016-07-18·CVSS 8.1
CVE-2016-5385 [HIGH] CVE-2016-5385: PHP through 7
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1609.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1610.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1611.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1612.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1613.htmlhttp://www.debian.org/security/2016/dsa-3631http://www.kb.cert.org/vuls/id/797896http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlhttp://www.securityfocus.com/bid/91821http://www.securitytracker.com/id/1036335https://bugzilla.redhat.com/show_bug.cgi?id=1353794https://github.com/guzzle/guzzle/releases/tag/6.2.1https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_ushttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722https://httpoxy.org/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/https://security.gentoo.org/glsa/201611-22https://www.drupal.org/SA-CORE-2016-003http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1609.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1610.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1611.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1612.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1613.htmlhttp://www.debian.org/security/2016/dsa-3631http://www.kb.cert.org/vuls/id/797896http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlhttp://www.securityfocus.com/bid/91821http://www.securitytracker.com/id/1036335https://bugzilla.redhat.com/show_bug.cgi?id=1353794https://github.com/guzzle/guzzle/releases/tag/6.2.1https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_ushttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722https://httpoxy.org/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/https://security.gentoo.org/glsa/201611-22https://www.drupal.org/SA-CORE-2016-003
2016-07-19
Published