Description
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | php5 | 5.6.24+dfsg-0+deb8u1 | DSA-3631-1 |
| Debian 7 | php5 | 5.4.45-0+deb7u6 | DLA-749-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | php7.0 | 7.0.8-0ubuntu0.16.04.2 | USN-3045-1 |
| Ubuntu 14.04 LTS | php5 | 5.5.9+dfsg-1ubuntu4.19 | USN-3045-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | php +24 | 5.4.16-36.3.el7_2 | RHSA-2016:1613 |
| RHEL 6 | php +26 | 5.3.3-48.el6_8 | RHSA-2016:1609 |
| RHEL 2 | php54-php +24 | 5.4.40-4.el6 | RHSA-2016:1610 |
| RHEL 2 | php55-php +26 | 5.5.21-5.el6 | RHSA-2016:1611 |
| RHEL 2 | rh-php56-php +27 | 5.6.5-9.el6 | RHSA-2016:1612 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | php7 | 7.0.7-25.1 | SUSE-SU-2016:2941-1 |
| SLES 12 SP1 | php5 | 5.5.14-68.1 | SUSE-SU-2016:1842-1 |
| SLES 12 SP1 | php7 | 7.0.7-25.1 | SUSE-SU-2016:2941-1 |
| SLES 12 | php5 | 5.5.14-68.1 | SUSE-SU-2016:1842-1 |
| SLES 12 | php7 | 7.0.7-25.1 | SUSE-SU-2016:2941-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | platformsh-cli | 3.67.2-1.2 | openSUSE-SU-2024:11175-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | php +24 | 5.4.16-36.3.el7_2 | ELSA-2016-1613 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | amphp/artax | < 1.0.4 | 1.0.4 | GHSA-m6ch-gg5f-wxx3 |
| Packagist | amphp/artax | >= 2.0.0, < 2.0.4 | 2.0.4 | GHSA-m6ch-gg5f-wxx3 |
| Packagist | bugsnag/bugsnag-laravel | < 2.0.2 | 2.0.2 | GHSA-m6ch-gg5f-wxx3 |
| Packagist | drupal/core | >= 8.0, < 8.1.7 | 8.1.7 | GHSA-m6ch-gg5f-wxx3 |
| Packagist | guzzlehttp/guzzle | >= 6, < 6.2.1 | 6.2.1 | GHSA-m6ch-gg5f-wxx3 |
| Packagist | guzzlehttp/guzzle | >= 4.0.0-rc2, < 4.2.4 | 4.2.4 | GHSA-m6ch-gg5f-wxx3 |
| Packagist | guzzlehttp/guzzle | >= 5, < 5.3.1 | 5.3.1 | GHSA-m6ch-gg5f-wxx3 |
| Packagist | padraic/humbug_get_contents | < 1.1.2 | 1.1.2 | GHSA-m6ch-gg5f-wxx3 |
Advisories 16
- RHSA-2016:1613 Red Hat Security Advisory: php security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1612 Red Hat Security Advisory: rh-php56-php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1611 Red Hat Security Advisory: php55-php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1609 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1610 Red Hat Security Advisory: php54-php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3045-1 php5, php7.0 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-749-1 php5 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3631-1 php5 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11175-1 platformsh-cli-3.67.2-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2941-1 Security update for php7 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1842-1 Security update for php5 SUSE / openSUSE Security Updates · Feb 4, 2026
- FSA-202302 Festo: Several vulnerabilities in FactoryViews CERT@VDE · Feb 2, 2026
- ICSA-26-027-02 Festo Didactic SE MES PC CISA ICS & IT advisories · Jan 27, 2026
- FSA-202402 Several Vulnerabilities in MES PC (Windows 10) CERT@VDE · Dec 8, 2025
- WID-SEC-2025-2522 Mehrere Webserver: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 10, 2025
- ELSA-2016-1613 Moderate: php security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 11, 2016
References
- FEDORA-2016-8eb11666aa vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297
- VU#797896 third-party-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- GLSA-201611-22 vendor-advisory
- openSUSE-SU-2016:1922 vendor-advisory
- https://www.drupal.org/SA-CORE-2016-003
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- RHSA-2016:1613 vendor-advisory
- RHSA-2016:1611 vendor-advisory
- RHSA-2016:1610 vendor-advisory
- DSA-3631 vendor-advisory
- 91821 vdb-entry
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
- FEDORA-2016-4e7db3d437 vendor-advisory
- RHSA-2016:1609 vendor-advisory
- 1036335 vdb-entry
- https://httpoxy.org/
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- RHSA-2016:1612 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1353794
- FEDORA-2016-9c8cf5912c vendor-advisory
- https://github.com/guzzle/guzzle/releases/tag/6.2.1