K01153535: BIG-IP AWS vulnerability CVE-2021-23051

Security Advisory Description When the Data Plane Development Kit DPDK/Elastic Network Adapter ENA driver is used with BIG-IP on Amazon Web Services AWS systems, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. This is due to an incomplete fix for CVE-2020-5862...

K07944249: Node.js vulnerability CVE-2020-8277

Security Advisory Description A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions 15.2.1, 14.15.1, and 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is...

K33924005: Oracle Java SE vulnerability CVE-2018-2799

Security Advisory Description Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JAXP. Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows...

K30573026: BIG-IP virtual server with FastL4 profile vulnerability CVE-2022-23027

Security Advisory Description When a FastL4 profile and an HTTP, FIX, and/or hash persistence profile are configured on the same virtual server, undisclosed requests can cause the virtual server to stop processing new client connections. CVE-2022-23027 Impact Traffic is disrupted for new client...

K64829234: BIG-IP and BIG-IQ mcpd vulnerability CVE-2022-41694

Security Advisory Description When an SSL key is imported on a BIG-IP or BIG-IQ system, undisclosed input can cause the mcpd process to terminate. CVE-2022-41694 Impact Traffic is disrupted while the mcpd process restarts. This vulnerability allows a remote, authenticated attacker to cause a...

K46514822: Linux TCP stack vulnerability CVE-2016-5696

Security Advisory Description net/ipv4/tcpinput.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. CVE-2016-5696 Impact Attackers may be able to...

K68785753: ImageMagick vulnerability CVE-2015-8898

Security Advisory Description The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted image file. CVE-2015-8898 Impact BIG-IP systems that use a WebAcceleration profile configured wit...

K63497634: BIG-IP FPS XSS vulnerability CVE-2021-22979

Security Advisory Description A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned, which allows an attacker to execute JavaScript in the context of the current logged-in user...

K28003839: tmsh utility vulnerability CVE-2018-15322

Security Advisory Description A BIG-IP user granted with tmsh access may cause the BIG-IP system to experience denial-of-service DoS when the BIG-IP user uses the tmsh utility to run the edit cli preference command and proceeds to save the changes to another filename repeatedly. This action...

K55543151: BIG-IP TMUI vulnerability CVE-2021-23025

Security Advisory Description An authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. CVE-2021-23025 Impact This vulnerability may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or...

K49237345: BIG-IP Advanced WAF, ASM, and NGINX App Protect WAF XML encoding security exposure

Security Advisory Description F5 BIG-IP Advanced WAF, BIG-IP ASM, or NGINX App Protect WAF incorrectly handles certain requests. This issue occurs when the following condition is met: Advanced WAF, BIG-IP ASM, or NGINX App Protect WAF handles a malicious request with XML content type and XML...

K44462254: Reflected Cross-Site Scripting (XSS) vulnerability CVE-2018-15312

Security Advisory Description A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15312 Impact A remote unauthenticated attacker...

K95117754: TMM vulnerability CVE-2019-6684

Security Advisory Description Under certain conditions, a multi-bladed BIG-IP Virtual Clustered Multiprocessing vCMP may drop broadcast packets when they are rebroadcast to the vCMP guest secondary blades. An attacker can leverage the fragmented broadcast IP packets to perform any type of...

K14969: BIG-IP Edge and FirePass client information leakage vulnerability CVE-2013-6024

Security Advisory Description The Edge Client components in F5 BIG-IP APM, BIG-IP Edge Gateway, and FirePass allow attackers to obtain sensitive information from process memory via unspecified vectors. CVE-2013-6024 Impact An attacker with sufficient local privileges on a client machine running...

K35209601: BIG-IP snmpd vulnerability CVE-2019-6606

Security Advisory Description When processing certain SNMP requests with a request-id of 0, the snmpd process may leak a small amount of memory. CVE-2019-6606 Impact When a remote attacker exploits this vulnerability, the BIG-IP system may consume excessive amounts of memory, which can result in ...

K14229426: BIG-IP SSL vulnerability CVE-2022-29491

Security Advisory Description When a virtual server is configured with HTTP, TCP on one side client/server, and DTLS on the other server/client, undisclosed requests can cause the TMM process to terminate. CVE-2022-29491 Impact Traffic is disrupted while the TMM process restarts. This vulnerabili...

K45421311: BIG-IP TMM vulnerability CVE-2020-5925

Security Advisory Description Undisclosed internally-generated User Datagram Protocol UDP traffic may cause the Traffic Management Microkernel TMM to restart under some circumstances.CVE-2020-5925 A BIG-IP system experiencing this vulnerability may log the following error message to the...

K42526507: BIG-IP TMUI vulnerability CVE-2021-23041

Security Advisory Description A DOM based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2021-23041 Impact An attacker may exploit this...

K01054113: BIG-IP AWS vulnerability CVE-2020-5862

Security Advisory Description Under certain conditions, while sending traffic, the Traffic Management Microkernel TMM may produce a core file or stop processing new traffic with the Data Plane Development Kit DPDK/Elastic Network Adapter ENA driver on Amazon Web Services AWS systems. CVE-2020-586...

K02043709: Appliance mode tmsh access vulnerability CVE-2018-5520

Security Advisory Description On a BIG-IP system configured in Appliance mode, the TMOS Shell tmsh may allow an administrative user to use the dig utility to gain unauthorized access to file system resources. CVE-2018-5520 Note : Appliance mode is designed to meet the needs of customers in...