Skip to content
OpenAdvisories
Medium ELSA-2016-1613 1 CVE

Moderate: php security and bug fix update (Oracle Linux 7)

Published Aug 11, 2016 · Updated Aug 11, 2016

Ecosystem: Oracle Linux

Summary

[5.4.16-36.3]
- don't set environmental variable based on user supplied Proxy
request header CVE-2016-5385

[5.4.16-36.2]
- fix segmentation fault in header_register_callback #1346758

Fixed packages 25

ReleasePackageFixed in
Oracle Linux · 7 php 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-bcmath 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-cli 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-common 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-dba 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-devel 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-embedded 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-enchant 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-fpm 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-gd 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-intl 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-ldap 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-mbstring 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-mysql 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-mysqlnd 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-odbc 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-pdo 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-pgsql 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-process 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-pspell 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-recode 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-snmp 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-soap 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-xml 0:5.4.16-36.3.el7_2
Oracle Linux · 7 php-xmlrpc 0:5.4.16-36.3.el7_2

Vulnerabilities 1

  • High 8.1
    CVE-2016-5385 EPSS 50%

    HTTP Proxy header vulnerability

    PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redi…

    php5 php7.0 drupal/core guzzlehttp/guzzle Ubuntu Packagist