CVE-2016-5387 in macOS

Resumen (Inglés)

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Reservar

2016-06-10

Divulgación

2016-07-18

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
108930	Apple macOS apache escalada de privilegios	284	No está definido	Arreglo oficial	CVE-2016-5387
103831	Oracle Enterprise Manager Ops Center Satellite escalada de privilegios	284	No está definido	Arreglo oficial	CVE-2016-5387
98603	Apple macOS Apache escalada de privilegios	284	No está definido	Arreglo oficial	CVE-2016-5387
89849	nginx RFC 3875 Namespace Conflict escalada de privilegios	284	No está definido	Arreglo oficial	CVE-2016-5387
89669	Apache HTTP Server RFC 3875 Namespace Conflict escalada de privilegios	284	No está definido	Arreglo oficial	CVE-2016-5387

Fuentes

• MITRE
• NVD
• CVE Details