CVE ID:	CVE-2016-5385
Description:	PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Test IDs:	1.3.6.1.4.1.25623.1.0.808628   1.3.6.1.4.1.25623.1.0.808272   1.3.6.1.4.1.25623.1.0.808627   1.3.6.1.4.1.25623.1.0.808721   1.3.6.1.4.1.25623.1.0.882542   1.3.6.1.4.1.25623.1.0.808723   1.3.6.1.4.1.25623.1.0.871650   1.3.6.1.4.1.25623.1.0.808733   1.3.6.1.4.1.25623.1.0.808738   1.3.6.1.4.1.25623.1.0.808725   1.3.6.1.4.1.25623.1.0.808728   1.3.6.1.4.1.25623.1.0.882540   1.3.6.1.4.1.25623.1.0.871649   1.3.6.1.4.1.25623.1.0.120717
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2016-5385 BugTraq ID: 91821 http://www.securityfocus.com/bid/91821 CERT/CC vulnerability note: VU#797896 http://www.kb.cert.org/vuls/id/797896 Debian Security Information: DSA-3631 (Google Search) http://www.debian.org/security/2016/dsa-3631 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/ https://security.gentoo.org/glsa/201611-22 https://httpoxy.org/ RedHat Security Advisories: RHSA-2016:1609 http://rhn.redhat.com/errata/RHSA-2016-1609.html RedHat Security Advisories: RHSA-2016:1610 http://rhn.redhat.com/errata/RHSA-2016-1610.html RedHat Security Advisories: RHSA-2016:1611 http://rhn.redhat.com/errata/RHSA-2016-1611.html RedHat Security Advisories: RHSA-2016:1612 http://rhn.redhat.com/errata/RHSA-2016-1612.html RedHat Security Advisories: RHSA-2016:1613 http://rhn.redhat.com/errata/RHSA-2016-1613.html http://www.securitytracker.com/id/1036335 SuSE Security Announcement: openSUSE-SU-2016:1922 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html