Skip to content
OpenAdvisories
High WID-SEC-2025-2522 11 CVEs

Mehrere Webserver: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Published Jul 18, 2016 · Updated Nov 10, 2025 · Revision 59 · de-DE

Vendor: Apache Vendor: Debian Vendor: EMC Vendor: HPE Vendor: Red Hat Vendor: SUSE Vendor: TYPO3 Vendor: Ubuntu Product: Core Product: Enterprise Linux Product: HP-UX Product: HTTP Server Product: JBoss Web Server Product: Linux Product: Linux Product: Linux Product: Linux Enterprise Desktop Product: Linux Enterprise Server Product: openSUSE Product: Tomcat Product: VNX1 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in mehreren Webserver Produkten ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

PHP ist eine Programmiersprache, die zur Implementierung von Web-Applikationen genutzt wird.
Apache Tomcat ist ein Web-Applikationsserver für verschiedene Plattformen.
Apache ist ein Webserver für verschiedene Plattformen.
Python ist eine universelle, üblicherweise interpretierte höhere Programmiersprache.

Vulnerabilities 11

  • High 8.1
    CVE-2016-5385 EPSS 50%

    HTTP Proxy header vulnerability

    PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redi…

    php5 php7.0 drupal/core guzzlehttp/guzzle Ubuntu Packagist
  • High 8.1
    CVE-2016-5388 EPSS 51%

    Improper Access Control in Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might…

    tomcat8 tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • Medium 5.3
    CVE-2016-1000111

    Forced Browsing in Twisted

    Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers…

    twisted twisted twisted py3-twisted Debian Ubuntu Alpine PyPI
  • Unscored —
    CVE-2016-1000104

    A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.

    libapache2-mod-fcgid mod_fcgid Ubuntu Azure Linux
  • Unscored —
    CVE-2016-1000105 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…

    nginx Ubuntu
  • Unscored —
    CVE-2016-1000107

    inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications f…

    erlang erlang Debian Ubuntu
  • Unscored —
    CVE-2016-1000108

    yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protec…

    yaws yaws Debian Ubuntu
  • Unscored —
    CVE-2016-1000109

    HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applica…

    hhvm Ubuntu
  • Unscored —
    CVE-2016-1000110

    The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI scrip…

    python3.4 python3.5 python2.7 python2.7 Debian Ubuntu
  • Unscored —
    CVE-2016-5386

    Improper input validation in net/http and net/http/cgi

    The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow…

    golang stdlib golang-1.6 Ubuntu Azure Linux Go
  • Unscored —
    CVE-2016-5387 EPSS 56%

    The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from …

    apache2 apache2 apache2 Debian Ubuntu Alpine

Revision history

  1. #59

    Korrektur

  2. #58

    Neue Updates von openSUSE aufgenommen

  3. #57

    Referenz(en) aufgenommen: FEDORA-2019-AA7F37CD4D

  4. #56

    Neue Updates von SUSE aufgenommen

  5. #55

    Neue Updates von EMC aufgenommen

  6. #54

    Added references

  7. #53

    New remediations available

  8. #50

    New remediations available

  9. #51

    New remediations available

  10. #52

    Version nicht vorhanden

  11. #49

    New remediations available

  12. #48

    New remediations available

  13. #47

    New remediations available

  14. #46

    New remediations available

  15. #45

    New remediations available

  16. #43

    New remediations available

  17. #44

    Version nicht vorhanden

  18. #42

    New remediations available

  19. #41

    New remediations available

  20. #39

    New remediations available

  21. #40

    Version nicht vorhanden

  22. #38

    New remediations available

  23. #32

    New remediations available

  24. #33

    Version nicht vorhanden

  25. #34

    Version nicht vorhanden

References