diff options
| -rw-r--r-- | security/vuxml/vuln.xml | 93 |
1 files changed, 93 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 2753aa8eb13..b12f3deb860 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,99 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="cf0b5668-4d1b-11e6-b2ec-b499baebfeaf"> + <topic>Multiple ports -- Proxy HTTP header vulnerability (httpoxy)</topic> + <affects> + <package> + <name>apache22</name> + <range><ge>0</ge></range> + </package> + <package> + <name>apache24</name> + <range><ge>0</ge></range> + </package> + <package> + <name>tomcat6</name> + <range><ge>0</ge></range> + </package> + <package> + <name>tomcat7</name> + <range><ge>0</ge></range> + </package> + <package> + <name>tomcat8</name> + <range><ge>0</ge></range> + </package> + <package> + <name>php55</name> + <range><ge>0</ge></range> + </package> + <package> + <name>php56</name> + <range><ge>0</ge></range> + </package> + <package> + <name>php70</name> + <range><ge>0</ge></range> + </package> + <package> + <name>nginx</name> + <range><ge>0</ge></range> + </package> + <package> + <name>go</name> + <range><ge>0</ge></range> + </package> + <package> + <name>go14</name> + <range><ge>0</ge></range> + </package> + <package> + <name>python27</name> + <range><ge>0</ge></range> + </package> + <package> + <name>python33</name> + <range><ge>0</ge></range> + </package> + <package> + <name>python34</name> + <range><ge>0</ge></range> + </package> + <package> + <name>python35</name> + <range><ge>0</ge></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>httpoxy.org reports:</p> + <blockquote cite="https://httpoxy.org/"> + <p>httpoxy is a set of vulnerabilities that affect application code + running in CGI, or CGI-like environments. It comes down to a simple + namespace conflict:.</p> + <ul><li>RFC 3875 (CGI) puts the HTTP Proxy header from a request into + the environment variables as HTTP_PROXY</li> + <li>HTTP_PROXY is a popular environment variable used to configure + an outgoing proxy</li></ul> + <p>This leads to a remotely exploitable vulnerability.</p> + </blockquote> + </body> + </description> + <references> + <url>https://httpoxy.org/</url> + <url>https://www.kb.cert.org/vuls/id/797896</url> + <url>CVE-2016-5385</url> + <url>CVE-2016-5386</url> + <url>CVE-2016-5388</url> + <url>CVE-2016-1000110</url> + </references> + <dates> + <discovery>2016-07-18</discovery> + <entry>2016-07-18</entry> + </dates> + </vuln> + <vuln vid="00cb1469-4afc-11e6-97ea-002590263bf5"> <topic>atutor -- multiple vulnerabilites</topic> <affects> |