CVE-2016-4694

The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue, a related issue to CVE-2016-5387.

• CWE-284

• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00009.htmlMailing List, Vendor Advisory
• http://www.securityfocus.com/bid/93060
• http://www.securitytracker.com/id/1036853
• https://support.apple.com/HT207170Vendor Advisory
• https://support.apple.com/HT207171Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.htmlMailing List, Vendor Advisory
• http://lists.apple.com/archives/security-announce/2016/Sep/msg00009.htmlMailing List, Vendor Advisory
• http://www.securityfocus.com/bid/93060
• http://www.securitytracker.com/id/1036853
• https://support.apple.com/HT207170Vendor Advisory
• https://support.apple.com/HT207171Vendor Advisory

Published

Sep 25, 2016

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4688An issue was discovered in certain Apple products. iOS befor…
• CVE-2016-4689An issue was discovered in certain Apple products. iOS befor…
• CVE-2016-4690An issue was discovered in certain Apple products. iOS befor…
• CVE-2016-4691An issue was discovered in certain Apple products. iOS befor…
• CVE-2016-4692An issue was discovered in certain Apple products. iOS befor…
• CVE-2016-4693An issue was discovered in certain Apple products. iOS befor…
• CVE-2016-4695Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-4696AppleEFIRuntime in Apple OS X before 10.12 allows attackers …
• CVE-2016-4697Apple HSSPI Support in Apple OS X before 10.12 allows attack…
• CVE-2016-4698AppleMobileFileIntegrity in Apple iOS before 10 and OS X bef…
• CVE-2016-4699AppleUUC in Apple OS X before 10.12 allows attackers to exec…
• CVE-2016-4700AppleUUC in Apple OS X before 10.12 allows attackers to exec…