CVE catalog
CVE-2016-1000104
Security update for apache2-mod_fcgid
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.23% · Oct 25, 2026
This update for apache2-mod_fcgid fixes the following issues: * It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-1000104). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated Apache server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes (unless a value has been explicitly configured by the administrator in the configuration file). (bsc#988492)
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Suse | apache2-mod_fcgid | linux enterprise software development kit 11 sp4 | 2.2-31.29.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Suse | apache2-mod_fcgid | rpm | linux enterprise software development kit 11 sp4 | 2.2-31.29.1 | Not reported | SUSE-SU-2016:1820-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: