CVE catalog

CVE-2016-5385

Security update for php7

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
50.43% · Oct 27, 2026

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuphp514.045.5.3+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.3+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.6+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.8+dfsg-2ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.1vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.2vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.3vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.4vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.5vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.6vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.7vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.9vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.11vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.12vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.13vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.14vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.16vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.17vulnerable
Ubuntuphp514.045.5.9+dfsg-1ubuntu4.19fixed
Ubuntuphp7.016.047.0.1-5vulnerable
Ubuntuphp7.016.047.0.1-6vulnerable
Ubuntuphp7.016.047.0.2-1vulnerable
Ubuntuphp7.016.047.0.2-3vulnerable
Ubuntuphp7.016.047.0.2-4vulnerable
Ubuntuphp7.016.047.0.2-5vulnerable
Ubuntuphp7.016.047.0.3-2vulnerable
Ubuntuphp7.016.047.0.3-3vulnerable
Ubuntuphp7.016.047.0.3-9ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-5ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu1vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2vulnerable
Ubuntuphp7.016.047.0.4-7ubuntu2.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.1vulnerable
Ubuntuphp7.016.047.0.8-0ubuntu0.16.04.2fixed
Debianphp575.4.11-1vulnerable
Debianphp575.4.15-1vulnerable
Debianphp575.4.34-0+deb7u1vulnerable
Debianphp575.4.35-0+deb7u1vulnerable
Debianphp575.4.35-0+deb7u2vulnerable
Debianphp575.4.36-0+deb7u1vulnerable
Debianphp575.4.36-0+deb7u3vulnerable
Debianphp575.4.38-0+deb7u1vulnerable
Debianphp575.4.39-0+deb7u1vulnerable
Debianphp575.4.39-0+deb7u2vulnerable
Debianphp575.4.4-14vulnerable
Debianphp575.4.4-14+deb7u1vulnerable
Debianphp575.4.4-14+deb7u10vulnerable
Debianphp575.4.4-14+deb7u11vulnerable
Debianphp575.4.4-14+deb7u12vulnerable
Debianphp575.4.4-14+deb7u13vulnerable
Debianphp575.4.4-14+deb7u14vulnerable
Debianphp575.4.4-14+deb7u2vulnerable
Debianphp575.4.4-14+deb7u3vulnerable
Debianphp575.4.4-14+deb7u4vulnerable
Debianphp575.4.4-14+deb7u5vulnerable
Debianphp575.4.4-14+deb7u7vulnerable
Debianphp575.4.4-14+deb7u8vulnerable
Debianphp575.4.4-14+deb7u9vulnerable
Debianphp575.4.4-15vulnerable
Debianphp575.4.4-15.1vulnerable
Debianphp575.4.41-0+deb7u1vulnerable
Debianphp575.4.44-0+deb7u1vulnerable
Debianphp575.4.45-0+deb7u1vulnerable
Debianphp575.4.45-0+deb7u2vulnerable
Debianphp575.4.45-0+deb7u3vulnerable
Debianphp575.4.45-0+deb7u4vulnerable
Debianphp575.4.45-0+deb7u5vulnerable
Debianphp575.4.6-1vulnerable
Debianphp575.4.6-2vulnerable
Debianphp575.4.8-1vulnerable
Debianphp575.4.9-1vulnerable
Debianphp575.4.9-2vulnerable
Debianphp575.4.9-3vulnerable
Debianphp575.4.9-4vulnerable
Debianphp575.4.45-0+deb7u6fixed
Debianphp585.6.11+dfsg-1vulnerable
Debianphp585.6.12+dfsg-0+deb8u1vulnerable
Debianphp585.6.12+dfsg-1vulnerable
Debianphp585.6.13+dfsg-0+deb8u1vulnerable
Debianphp585.6.13+dfsg-1vulnerable
Debianphp585.6.13+dfsg-2vulnerable
Debianphp585.6.14+dfsg-0+deb8u1vulnerable
Debianphp585.6.14+dfsg-1vulnerable
Debianphp585.6.15+dfsg-1vulnerable
Debianphp585.6.16+dfsg-1vulnerable
Debianphp585.6.16+dfsg-2vulnerable
Debianphp585.6.16+dfsg-3vulnerable
Debianphp585.6.16+dfsg-4vulnerable
Debianphp585.6.17+dfsg-0+deb8u1vulnerable
Debianphp585.6.17+dfsg-1vulnerable
Debianphp585.6.17+dfsg-3vulnerable
Debianphp585.6.18+dfsg-1vulnerable
Debianphp585.6.19+dfsg-0+deb8u1vulnerable
Debianphp585.6.19+dfsg-1vulnerable
Debianphp585.6.19+dfsg-2vulnerable
Debianphp585.6.20+dfsg-0+deb8u1vulnerable
Debianphp585.6.20+dfsg-1vulnerable
Debianphp585.6.21+dfsg-1vulnerable
Debianphp585.6.21+dfsg-2vulnerable
Debianphp585.6.22+dfsg-0+deb8u1vulnerable
Debianphp585.6.22+dfsg-1vulnerable
Debianphp585.6.22+dfsg-2vulnerable
Debianphp585.6.23+dfsg-0+deb8u1vulnerable
Debianphp585.6.23+dfsg-1vulnerable
Debianphp585.6.7+dfsg-1vulnerable
Debianphp585.6.9+dfsg-0+deb8u1vulnerable
Debianphp585.6.9+dfsg-1vulnerable
Debianphp585.6.24+dfsg-0+deb8u1fixed
Opensuseplatformsh-clitumbleweed3.67.2-1.2fixed
Susephp7linux enterprise module for web and scripting 127.0.7-25.1fixed
Susephp7linux enterprise software development kit 12 sp17.0.7-25.1fixed
Susephp7linux enterprise software development kit 12 sp27.0.7-25.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntuphp5deb14.045.5.9+dfsg-1ubuntu4.19Not reportedUBUNTU-CVE-2016-5385Not reported
Ubuntuphp7.0deb16.047.0.8-0ubuntu0.16.04.2Not reportedUBUNTU-CVE-2016-5385Not reported
Debianphp5deb75.4.45-0+deb7u6Not reportedDLA-749-1Not reported
Debianphp5deb85.6.24+dfsg-0+deb8u1Not reportedDSA-3631-1Not reported
Opensuseplatformsh-clirpmtumbleweed3.67.2-1.2Not reportedOPENSUSE-SU-2024:11175-1Not reported
Susephp7rpmlinux enterprise module for web and scripting 127.0.7-25.1Not reportedSUSE-SU-2016:2941-1Not reported
Susephp7rpmlinux enterprise software development kit 12 sp17.0.7-25.1Not reportedSUSE-SU-2016:2941-1Not reported
Susephp7rpmlinux enterprise software development kit 12 sp27.0.7-25.1Not reportedSUSE-SU-2016:2941-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [platformsh-cli]Fixed

    Source package: [platformsh-cli]

    Details (1)

    • 3.67.2-1.14 · noarch · tumbleweed

      Fixed · Fixed: 3.67.2-1.2

      pypi · platformsh-cli · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]