Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-5353 State: PUBLISHED Published: 2016-08-07T16:00:00 Last Updated: 2024-08-06T01:00:59.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the reserved C/T value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2016-32.html - http://www.openwall.com/lists/oss-security/2016/06/09/3 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - http://www.debian.o
rity/2016/06/09/3 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - http://www.debian.org/security/2016/dsa-3615 - http://www.securityfocus.com/bid/91140 - https://github.com/wireshark/wireshark/commit/7d7190695ce2ff269fdffb04e87139995cde21f4 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12191
CVE ID: CVE-2016-5354 State: PUBLISHED Published: 2016-08-07T16:00:00 Last Updated: 2024-08-06T01:00:59.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: The USB subsystem in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles class types, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12356 - https://www.wireshark.org/security/wnpa-sec-2016-33.html - http://www.openwall.com/lists/oss-security/2016/06/09/3 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://gi
/oss-security/2016/06/09/3 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://github.com/wireshark/wireshark/commit/2cb5985bf47bdc8bea78d28483ed224abdd33dc6 - http://www.debian.org/security/2016/dsa-3615 - http://www.securityfocus.com/bid/91140
CVE ID: CVE-2016-5355 State: PUBLISHED Published: 2016-08-07T16:00:00 Last Updated: 2024-08-06T01:00:59.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: wiretap/toshiba.c in the Toshiba file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12394 - http://www.openwall.com/lists/oss-security/2016/06/09/3 - https://www.wireshark.org/security/wnpa-sec-2016-34.html - http://www.oracle.com/technetwork/topics/se
ty/2016/06/09/3 - https://www.wireshark.org/security/wnpa-sec-2016-34.html - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://github.com/wireshark/wireshark/commit/3270dfac43da861c714df76513456b46765ff47f - http://www.debian.org/security/2016/dsa-3615 - http://www.securityfocus.com/bid/91140 - https://github.com/wireshark/wireshark/commit/5efb45231671baa2db2011d8f67f9d6e72bc455b
CVE ID: CVE-2016-5356 State: PUBLISHED Published: 2016-08-07T16:00:00 Last Updated: 2024-08-06T01:00:59.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: wiretap/cosine.c in the CoSine file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/06/09/3 - https://github.com/wireshark/wireshark/commit/f5ec0afb766f19519ea9623152cca3bbe2229500 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.h
t/f5ec0afb766f19519ea9623152cca3bbe2229500 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://github.com/wireshark/wireshark/commit/a66628e425db725df1ac52a3c573a03357060ddd - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12395 - http://www.debian.org/security/2016/dsa-3615 - http://www.securityfocus.com/bid/91140 - https://www.wireshark.org/security/wnpa-sec-2016-35.html
CVE ID: CVE-2016-5357 State: PUBLISHED Published: 2016-08-07T16:00:00 Last Updated: 2024-08-06T01:00:59.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: wiretap/netscreen.c in the NetScreen file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireshark/wireshark/commit/6a140eca7b78b230f1f90a739a32257476513c78 - http://www.openwall.com/lists/oss-security/2016/06/09/3 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-309
www.openwall.com/lists/oss-security/2016/06/09/3 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12396 - https://www.wireshark.org/security/wnpa-sec-2016-36.html - http://www.debian.org/security/2016/dsa-3615 - http://www.securityfocus.com/bid/91140 - https://github.com/wireshark/wireshark/commit/11edc83b98a61e890d7bb01855389d40e984ea82
CVE ID: CVE-2016-5358 State: PUBLISHED Published: 2016-08-07T16:00:00 Last Updated: 2024-08-06T01:01:00.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the packet-header data type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12440 - http://www.openwall.com/lists/oss-security/2016/06/09/3 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://github.com/wireshark/wireshark/c
ttp://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - https://github.com/wireshark/wireshark/commit/2c13e97d656c1c0ac4d76eb9d307664aae0e0cf7 - https://www.wireshark.org/security/wnpa-sec-2016-37.html - http://www.securityfocus.com/bid/91140
CVE ID: CVE-2016-5359 State: PUBLISHED Published: 2016-08-07T16:00:00 Last Updated: 2024-08-06T01:01:00.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 1.12.x before 1.12.12 mishandles offsets, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12408 - https://www.wireshark.org/security/wnpa-sec-2016-38.html - http://www.openwall.com/lists/oss-security/2016/06/09/3 - https://github.com/wireshark/wireshark/commit/b8e0d416898bb975a
ttp://www.openwall.com/lists/oss-security/2016/06/09/3 - https://github.com/wireshark/wireshark/commit/b8e0d416898bb975a02c1b55883342edc5b4c9c0 - http://www.debian.org/security/2016/dsa-3615 - http://www.securityfocus.com/bid/91140
CVE ID: CVE-2016-5360 State: PUBLISHED Published: 2016-06-30T17:00:00 Last Updated: 2024-08-06T01:00:59.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/06/09/6 - http://git.haproxy.org/?p=haproxy-1.6.git%3Ba=commit%3Bh=60f01f8c89e4fb2723d5a9f2046286e699567e0b - http://www.ubuntu.com/usn/USN-3011-1 - http://www.openwall.com/lists/oss-security/2016
9e4fb2723d5a9f2046286e699567e0b - http://www.ubuntu.com/usn/USN-3011-1 - http://www.openwall.com/lists/oss-security/2016/06/09/5
CVE ID: CVE-2016-5361 State: PUBLISHED Published: 2016-06-16T14:00:00 Last Updated: 2024-08-06T01:01:00.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each. Additional Analyst Notes: - CVE Program Container: R
-required security updates, with separate CVE IDs assigned to each. Additional Analyst Notes: - CVE Program Container: References: - https://lists.libreswan.org/pipermail/swan-dev/2016-March/001394.html - http://rhn.redhat.com/errata/RHSA-2016-2603.html - https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6 - http://www.openwall.com/lists/oss-security/2016/06/10/4
CVE ID: CVE-2016-5362 State: PUBLISHED Published: 2016-06-17T15:00:00 Last Updated: 2024-08-06T01:01:00.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:1473 - http://www.openwall.com/lists/oss-security/2016/06/10/5 - http://www.openwall.com/lists/oss-security/2016/06/10/6 - https://security.openstack.org
sts/oss-security/2016/06/10/5 - http://www.openwall.com/lists/oss-security/2016/06/10/6 - https://security.openstack.org/ossa/OSSA-2016-009.html - https://bugs.launchpad.net/neutron/+bug/1558658 - https://review.openstack.org/#/c/303572/ - https://review.openstack.org/#/c/300202/ - https://access.redhat.com/errata/RHSA-2016:1474 - https://review.openstack.org/#/c/303563/
CVE ID: CVE-2016-5363 State: PUBLISHED Published: 2016-06-17T15:00:00 Last Updated: 2024-08-06T01:00:59.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:1473 - https://review.openstack.org/#/c/299025/ - http://www.openwall.com/lists/oss-security/2016/06/10/5 - http://www.o
1473 - https://review.openstack.org/#/c/299025/ - http://www.openwall.com/lists/oss-security/2016/06/10/5 - http://www.openwall.com/lists/oss-security/2016/06/10/6 - https://security.openstack.org/ossa/OSSA-2016-009.html - https://bugs.launchpad.net/neutron/+bug/1558658 - https://access.redhat.com/errata/RHSA-2016:1474 - https://review.openstack.org/#/c/299021/ - https://review.openstack.org/#/c/299023/
CVE ID: CVE-2016-5364 State: PUBLISHED Published: 2017-02-17T17:00:00 Last Updated: 2024-08-06T01:00:59.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mantisbt/mantisbt/commit/5068df2dcf79c34741c746c9b27e0083f2a374da - https://mantisbt.org/bugs/view.php?id=20956 - https://github.com/mantisbt/mantisbt/commit/11ab3d6c82a1d3a89b1024f77349fb60a83743c5 - http://www.openwall.com/lists/oss-security/2016/0
om/mantisbt/mantisbt/commit/11ab3d6c82a1d3a89b1024f77349fb60a83743c5 - http://www.openwall.com/lists/oss-security/2016/06/11/5
CVE ID: CVE-2016-5365 State: PUBLISHED Published: 2016-06-14T14:00:00 Last Updated: 2024-08-06T01:00:59.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Huawei Honor WS851 routers with software 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges via unspecified vectors, aka HWPSIRT-2016-05051. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en
CVE ID: CVE-2016-5366 State: PUBLISHED Published: 2016-06-14T14:00:00 Last Updated: 2024-08-06T01:00:59.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to modify configuration data via vectors related to a "file injection vulnerability," aka HWPSIRT-2016-05052. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en
CVE ID: CVE-2016-5367 State: PUBLISHED Published: 2016-06-14T14:00:00 Last Updated: 2024-08-06T01:01:00.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors, aka HWPSIRT-2016-05053. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en
CVE ID: CVE-2016-5368 State: PUBLISHED Published: 2016-06-30T16:00:00 Last Updated: 2024-08-06T01:00:59.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted Multiprotocol Label Switching (MPLS) packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/91557 - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160608-01-mpls-en
CVE ID: CVE-2016-5372 State: PUBLISHED Published: 2017-02-07T17:00:00 Last Updated: 2024-08-06T01:01:00.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20160622-0001/ - https://kb.netapp.com/support/s/article/cve-2016-5372-cross-site-request-forgery-vulnerability-in-snap-creator-framework
CVE ID: CVE-2016-5374 State: PUBLISHED Published: 2017-03-01T20:00:00 Last Updated: 2024-08-06T01:00:58.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the owner_rights ACL entry. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/s/article/ka51A00000007IBQAY/NTAP-20170228-0002?language=en_US - http://www.securityfocus.com/bid/96524
CVE ID: CVE-2016-5383 State: PUBLISHED Published: 2016-08-26T14:00:00 Last Updated: 2024-08-06T01:01:00.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92585 - http://rhn.redhat.com/errata/RHSA-2016-1634.html
CVE ID: CVE-2016-5384 State: PUBLISHED Published: 2016-08-12T16:00:00 Last Updated: 2024-08-06T01:00:59.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGOS4YYB7UYAWX5AEXJZHDIX4ZMSXSW5/ - http://www.ubuntu.com/usn/USN-3063-1 - https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html - http://rhn.r
www.ubuntu.com/usn/USN-3063-1 - https://lists.freedesktop.org/archives/fontconfig/2016-August/005792.html - http://rhn.redhat.com/errata/RHSA-2016-2601.html - https://cgit.freedesktop.org/fontconfig/commit/?id=7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940 - http://www.securityfocus.com/bid/92339 - http://www.debian.org/security/2016/dsa-3644 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CJ45VRAMCIISHOVKFVOQYQUSTUJP7FC/
CVE ID: CVE-2016-5385 State: PUBLISHED Published: 2016-07-19T01:00:00 Last Updated: 2024-08-06T01:00:59.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue. Additional Analys
tion that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/ - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297 - http://www.kb.cert.org/vuls/id/797896 - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://security.gentoo.org/glsa/201611-22 - http://lists.opensuse.org/opensuse-updates/2016-08/msg
n2018-3236628.html - https://security.gentoo.org/glsa/201611-22 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html - https://www.drupal.org/SA-CORE-2016-003 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://rhn.redhat.com/errata/RHSA-2016-1613.html - http://rhn.redhat.com/errata/RHSA-2016-1611.html - http://rhn.redhat.com/errata/RHSA-2016-1610.html - http://www.debian.org/security/2016/dsa-3631 - http://www.securityfocus.com/bid/91821 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us - https:
-c05390722 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/ - http://rhn.redhat.com/errata/RHSA-2016-1609.html - http://www.securitytracker.com/id/1036335 - https://httpoxy.org/ - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - http://rhn.redhat.com/errata/RHSA-2016-1612.html - https://bugzilla.redhat.com/show_bug.cgi?id=1353794 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/ - https://github.com/
archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/ - https://github.com/guzzle/guzzle/releases/tag/6.2.1
CVE ID: CVE-2016-5386 State: PUBLISHED Published: 2016-07-19T01:00:00 Last Updated: 2024-08-06T01:00:59.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/79789
n "httpoxy" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/797896 - https://bugzilla.redhat.com/show_bug.cgi?id=1353798 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/ - http://rhn.redhat.com/errata/RHSA-2016-1538.html - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us - https://httpoxy.or
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us - https://httpoxy.org/ - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
CVE ID: CVE-2016-5387 State: PUBLISHED Published: 2016-07-19T01:00:00 Last Updated: 2024-08-06T01:00:59.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability. A
mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036330 - https://access.redhat.com/errata/RHSA-2016:1420 - https://access.redhat.com/errata/RHSA-2016:1635 - https://support.apple.com/HT208221 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 - http://www.securityfocus.com/bid/91816 - https://access.redhat.com/errata/RHSA-2016:1851 - http://www.ubuntu.com/usn/USN-3038-1 - http://www.kb.cert.org/vuls/id/797896 - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htm
8-1 - http://www.kb.cert.org/vuls/id/797896 - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://rhn.redhat.com/errata/RHSA-2016-1648.html - https://www.tenable.com/security/tns-2017-04 - http://rhn.redhat.com/errata/RHSA-2016-1625.html - http://www.debian.org/security/2016/dsa-3623 - http://rhn.redhat.com/errata/RHSA-2016-1649.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpes