K16837: tcpdump before 4.7.2 vulnerabilities CVE-2015-0261, CVE-2015-0261, CVE-2015-2153, CVE-2015-2154, CVE-2015-2155

Security Advisory Description Description CVE-2015-0261 Integer signedness error in the mobilityoptprint function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service out-of-bounds read and crash or possibly execute arbitrary code via a negativ...

K16838: XSS vulnerability in the BIG-IP and Enterprise Manager Configuration utilities CVE-2015-1470

Security Advisory Description Using the BIGIPAuthUsernameCookie value with/tmui/login.jsp can expose a cross-site scripting XSS security flaw. CVE-2015-1470 Impact Some login.jsp parameters may allow an attacker to bypass XSS protection mechanisms by using a crafted cookie. Security Advisory Stat...

K15159: OpenSSL vulnerability CVE-2014-0160

Security Advisory Description The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as...

K61974123: ImageMagick vulnerability CVE-2016-3718

Security Advisory Description The 1 HTTP and 2 FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery SSRF attacks via a crafted image. CVE-2016-3718 Note : This vulnerability is one of the series of vulnerabilities known as...

K25102203: ImageMagick vulnerability CVE-2016-3716

Security Advisory Description The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image. CVE-2016-3716 Note : This vulnerability is one of the series of vulnerabilities known as ImageTragick. Impact Exploiting this...

K12002065: BIG-IP ASM XSS vulnerability CVE-2020-5932

Security Advisory Description A cross-site scripting XSS vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that will be executed whe...

K22493037: The BIG-IP ASM system sends a received XML request with sensitive payload to the ICAP server

Security Advisory Description The BIG-IP ASM system sends a received XML request with sensitive payload to the Internet Content Adaptation Protocol ICAP server for inspection, regardless of any other settings. This issue occurs when all of the following conditions are met: The affected security...

K04160444: Intel CPU vulnerability CVE-2020-0592

Security Advisory Description Out of bounds write in BIOS firmware for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege and/or denial of service via local access. CVE-2020-0592 Impact There is no impact; F5 products are not affected by this...

K02705117: The BIG-IP ASM system may fail to properly mask the value of a configured sensitive parameter in the request event log

Security Advisory Description When you configure a sensitive parameter for a security policy, the BIG-IP ASM system may fail to properly mask the value in the request log. This issue occurs when all of the following conditions are met: You enabled the Cross-Site Request Forgery CSRF Protection...

K16970: TLS Finish Message vulnerability

Security Advisory Description The BIG-IP system does not verify every byte in the Finished message of a TLS handshake. Impact There is no impact; F5 does not consider this behavior a vulnerability. Security Advisory Status F5 Product Development has assigned ID 530963 to this issue, and has...

K26583415: MQTT vulnerability CVE-2018-15323

Security Advisory Description In certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action. CVE-2018-15323 Impact This vulnerability allows remote attackers to cause a...

K83093212: The BIG-IP ASM system may stop enforcing attack signatures after applying a security policy that includes a new signature

Security Advisory Description This issue occurs when all of the following conditions are met: Your BIG-IP ASM system is running versions 12.1.2 through 12.1.3.6. You configure multiple security policies on the BIG-IP ASM system. One of the security policies includes a new attack signature not...

K64124988: TMM IPv6 stack vulnerability CVE-2022-29479

Security Advisory Description When an IPv6 self IP address is configured and the ipv6.strictcompliance database key is enabled disabled by default on a BIG-IP system, undisclosed packets may cause decreased performance.CVE-2022-29479 Impact This vulnerability allows an unauthenticated attacker to...

K54431371: BIG-IP APM client for Linux and macOS vulnerability CVE-2018-5546

Security Advisory Description The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. CVE-2018-5546 Impact A...

K36228121: BIG-IP DHCPv6 vulnerability CVE-2019-6643

Security Advisory Description An attacker sending specifically crafted DHCPv6 requests through a BIG-IP virtual server configured with a DHCPv6 profile may be able to cause the Traffic Management Microkernel TMM process to produce a core file. CVE-2019-6643 Impact This vulnerability may allow an...

K35408374: BIG-IP compression driver vulnerability CVE-2021-23044

Security Advisory Description When the Intel QuickAssist Technology QAT compression driver is used on affected BIG-IP hardware and BIG-IP Virtual Edition VE platforms, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. CVE-2021-23044 Impact Traffic is disrupted whi...

K11220361: LibTIFF vulnerability CVE-2015-1547

Security Advisory Description The NeXTDecode function in tifnext.c in LibTIFF allows remote attackers to cause a denial of service uninitialized memory access via a crafted TIFF image, as demonstrated by libtiff5.tif. CVE-2015-1547 Impact This vulnerability allows a remote attacker to cause a...

K50974556: Overview of F5 vulnerabilities (August 2021)

Security Advisory Description On August 24, 2021, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated...

K94325657: BIG-IP restjavad vulnerability CVE-2020-5880

Security Advisory Description The restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server. CVE-2020-5880 Impact A remote attacker may be able to fill...

K53590702: BIG-IP engineering hotfix TMM vulnerability CVE-2020-5852

Security Advisory Description Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel TMM. This vulnerability affects TMM through a virtual server configured with a FastL4 profile. Traffic processing is disrupted while TMM restarts...