CVE:CVE-2016-5385
CNNVD:CNNVD-201607-538
PHP是一种在服务器端执行的脚本语言。
PHP 7.0.8版本及之前版本中存在输入验证错误漏洞。攻击者利用该漏洞通过HTTP请求中特制的Proxy标头将应用程序的出站HTTP流量重定向到任意代理服务器。
solution:Upgrade oracle communications_user_data_repository to a higher version than 10.0.0,10.0.1,12.0.0,and avoid the version 10.0.0,10.0.1,12.0.0; Upgrade oracle enterprise_manager_ops_center to a higher version than 12.2.2,12.3.2,and avoid the version 12.2.2,12.3.2; Upgrade oracle linux to a higher version than 6,7,and avoid the version 6,7; Upgrade fedoraproject fedora to a higher version than 23,24,and avoid the version 23,24; Upgrade hp storeever_msl6480_tape_library_firmware to a higher version than 5.09,and avoid the version (,5.09]; Upgrade hp system_management_homepage to a higher version than 7.5.5.0,and avoid the version (,7.5.5.0]; Upgrade php php to a higher version than 5.5.38,5.6.24,7.0.8,and avoid the version [5.5.0,5.5.38),[5.6.0,5.6.24),[7.0.0,7.0.8]; Upgrade redhat enterprise_linux_desktop to a higher version than 6.0,and avoid the version 6.0; Upgrade redhat enterprise_linux_server to a higher version than 6.0,and avoid the version 6.0; Upgrade redhat enterprise_linux_workstation to a higher version than 6.0,and avoid the version 6.0; Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade drupal drupal to a higher version than 8.1.7,and avoid the version [8.0.0,8.1.7)