CVE-2016-5385 in Communications BRM

Сводка (Английский)

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Резервировать

10.06.2016

Раскрытие

18.07.2016

Статус

Подтверждённый

Записи

VulDB provides additional information and datapoints for this CVE:

ИД	Уязвимость	CWE	Экс	Кон	CVE
111958	Oracle Communications BRM User Data Repository эскалация привилегий	284	Не определено	Официальное исправление	CVE-2016-5385
89667	PHP RFC 3875 Namespace Conflict эскалация привилегий	284	Не определено	Официальное исправление	CVE-2016-5385

Источники

• MITRE
• NVD
• CVE Details