CveMateVulnerability intelligence

CVE-2016-5385: debian debian_linux URL Redirection to Untrusted Site

Modified

AliasesRHSA-2016:1609RHSA-2016:1610RHSA-2016:1611+4 more

Published 19-07-2016Last modified 06-08-2024

Vulnerability summary

CVE-2016-5385 is a high (CVSS 8.1) URL Redirection to Untrusted Site vulnerability in debian debian_linux. EPSS estimates a 50.43% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.1 (NVD); no exploitation reported by the 5 checked sources; EPSS 50% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.1/10

010

High · v3.1 (NVD)

EPSS score

50.43%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Duplicates 1 · Related 3

DLA-749-1 DSA-3631-1 SUSE-SU-2016:1842-1 SUSE-SU-2016:2941-1 USN-3045-1 CVE-2016-1000100

Timeline

19-07-2016
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

CVSS metrics

5 scores · 3 sources · 3 versions

v3.18.1v3.05.0v2.05.1

EPSS trend

Probability

50.43%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 50.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-601URL Redirection to Untrusted SiteThe web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat116 products

enterprise_linux_desktop6.0
enterprise_linux_server6.0
enterprise_linux_workstation6.0
php< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-bcmath< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2

php-cli< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-common< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-dba< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-debuginfo< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-devel< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-embedded< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-enchant< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-fpm< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-gd< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-imap< 0:5.3.3-48.el6_8
php-intl< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-ldap< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-mbstring< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-mysql< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-mysqlnd< 0:5.4.16-36.3.el7_2
php-odbc< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-pdo< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-pgsql< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-process< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-pspell< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-recode< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-snmp< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-soap< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-tidy< 0:5.3.3-48.el6_8
php-xml< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-xmlrpc< 0:5.3.3-48.el6_8 | < 0:5.4.16-36.3.el7_2
php-zts< 0:5.3.3-48.el6_8
php54-php< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-bcmath< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-cli< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-common< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-dba< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-debuginfo< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-devel< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-enchant< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-fpm< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-gd< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-imap< 0:5.4.40-4.el6
php54-php-intl< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-ldap< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-mbstring< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-mysqlnd< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-odbc< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-pdo< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-pgsql< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-process< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-pspell< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-recode< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-snmp< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-soap< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-tidy< 0:5.4.40-4.el6
php54-php-xml< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php54-php-xmlrpc< 0:5.4.40-4.el6 | < 0:5.4.40-4.el7
php55-php< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-bcmath< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-cli< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-common< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-dba< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-debuginfo< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-devel< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-enchant< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-fpm< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-gd< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-gmp< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-imap< 0:5.5.21-5.el6
php55-php-intl< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-ldap< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-mbstring< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-mysqlnd< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-odbc< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-opcache< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-pdo< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-pgsql< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-process< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-pspell< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-recode< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-snmp< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-soap< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-tidy< 0:5.5.21-5.el6
php55-php-xml< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
php55-php-xmlrpc< 0:5.5.21-5.el6 | < 0:5.5.21-5.el7
rh-php56-php< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-bcmath< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-cli< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-common< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-dba< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-dbg< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-debuginfo< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-devel< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-embedded< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-enchant< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-fpm< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-gd< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-gmp< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-imap< 0:5.6.5-9.el6
rh-php56-php-intl< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-ldap< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-mbstring< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-mysqlnd< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-odbc< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-opcache< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-pdo< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-pgsql< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-process< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-pspell< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-recode< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-snmp< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-soap< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-tidy< 0:5.6.5-9.el6
rh-php56-php-xml< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7
rh-php56-php-xmlrpc< 0:5.6.5-9.el6 | < 0:5.6.5-9.el7

Show all 116

Oracle3 products

communications_user_data_repository10.0.0 | 10.0.1 | 12.0.0
enterprise_manager_ops_center12.2.2 | 12.3.2
linuxEOL6 | 7

Hp2 products

storeever_msl6480_tape_library_firmware≤ 5.09
system_management_homepage≤ 7.5.5.0

Opensuse2 products

leapEOL42.1
platformsh-cli&distro=openSUSE Tumbleweed< 3.67.2-1.2

Ubuntu2 products

php5< 5.5.9+dfsg-1ubuntu4.19
php7.0< 7.0.8-0ubuntu0.16.04.2

Debian1 product

debian_linuxEOL8.0

Drupal1 product

drupal≥ 8.0.0, < 8.1.7

Fedoraproject1 product

fedoraEOL23 | 24

Php1 product

php≥ 5.5.0, < 5.5.38 | ≥ 5.6.0, < 5.6.24 | ≥ 7.0.0, ≤ 7.0.8

9 vendors · 129 products

References

44 links

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149X Refsource CONFIRMThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297X Refsource CONFIRMThird Party Advisory
www.kb.cert.org/vuls/id/797896Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlX Refsource CONFIRMPatchThird Party Advisory
security.gentoo.org/glsa/201611-22Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.opensuse.org/opensuse-updates/2016-08/msg00003.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.drupal.org/SA-CORE-2016-003X Refsource CONFIRMThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlX Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-1613.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory

Show all 44 references

rhn.redhat.com/errata/RHSA-2016-1611.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-1610.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
www.debian.org/security/2016/dsa-3631Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/91821VDB EntryX Refsource BIDThird Party Advisory
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722X Refsource CONFIRMThird Party Advisory
h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_usX Refsource CONFIRMThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
rhn.redhat.com/errata/RHSA-2016-1609.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
www.securitytracker.com/id/1036335VDB EntryX Refsource SECTRACKThird Party Advisory
httpoxy.orgX Refsource MISCThird Party AdvisoryREPORT
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlX Refsource CONFIRMPatchThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-1612.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1353794X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB EntryREPORT
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
github.com/guzzle/guzzle/releases/tag/6.2.1X Refsource CONFIRMRelease NotesThird Party Advisory
access.redhat.com/errata/RHSA-2016:1609Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1609.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-5385REPORT
www.cve.org/CVERecord?id=CVE-2016-5385AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2016-5385Advisory
access.redhat.com/errata/RHSA-2016:1610Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1610.jsonAdvisory
access.redhat.com/errata/RHSA-2016:1611Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1611.jsonAdvisory
access.redhat.com/errata/RHSA-2016:1612Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1612.jsonAdvisory
access.redhat.com/errata/RHSA-2016:1613Advisory
bugzilla.redhat.com/show_bug.cgi?id=1346758REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1613.jsonAdvisory
ubuntu.com/security/CVE-2016-5385REPORT
php.net/ChangeLog-7.phpREPORT
ubuntu.com/security/notices/USN-3045-1Advisory
www.suse.com/security/cve/CVE-2016-5385WEB