F5 Networks BIG-IP : Custom monitor privilege escalation vulnerability (K00265182)

F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification EAV monitor script. CVE-2016-5020 Impact An attacker may be able to use a...

F5 Networks BIG-IP : SQLite vulnerability (K16950)

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service integer overflow and stack-based buffer overflow or possibly have unspecifie...

CVE-2016-4545

Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service resource consumption and Traffic Management Microkernel restart via an SSL alert during the handshake...

CVE-2016-4545

Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service resource consumption and Traffic Management Microkernel restart via an SSL alert during the handshake...

Design/Logic Flaw

Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service resource consumption and Traffic Management Microkernel restart via an SSL alert during the handshake...

CVE-2016-4545

CVE-2016-4545 affects F5 BIG-IP SSL/TLS handling. The vulnerability arises when SSL alerts are sent during the handshake, potentially causing unnecessary logging and resource consumption that may trigger a Traffic Management Microkernel (TMM) restart and a core file. According to F5 advisory K480...

F5 Networks BIG-IP : NTP vulnerability (K17528)

ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service infinite loop or crash by pointing the key file at the log file. CVE-2015-7850 Impact Under certain specific conditions, an attacker can send a set of packets to ntpd that will...

F5 Networks BIG-IP : PHP vulnerabilities (SOL17377)

Use after free vulnerability was found in unserialize function. We can create ZVAL and free it via Serializable::unserialize. However the unserialize will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code...

F5 Networks BIG-IP : Libpng vulnerability (SOL76930736)

Multiple buffer overflows in the 1 pngsetPLTE and 2 pnggetPLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service application crash or possibly have...

F5 Networks BIG-IP : BIG-IP SSL vulnerability (K48042976)

On virtual servers with Secure Sockets Layer SSL profiles enabled, an SSL alert sent during the handshake may produce unnecessary logging and resource consumption on a BIG-IP system that is running 11.5.4 FINAL, possibly causing the Traffic Management Microkernel TMM to restart and produce a core...

F5 Networks BIG-IP : OpenSSH vulnerabilities (K17263)

CVE-2015-6563 The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITORREQPAMINITCTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to...

F5 Networks BIG-IP : Multiple FreeType vulnerabilities (K16900)

CVE-2014-9657 The ttfaceloadhdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other impact via a crafted TrueType font. CVE-2014-9658 The...

F5 Networks BIG-IP : Apache vulnerability (K16863)

The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states 'this is not a security issue in httpd as such.' CVE-2013-5704 C...

F5 Networks BIG-IP : QEMU vulnerability (K75248350)

The 1 fwcfgwrite and 2 fwcfgread functions in hw/nvram/fwcfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAPSYSRAWIO privilege to cause a denial of service out-of-bounds read or write access and process crash or possibly...

F5 Networks BIG-IP : NTP vulnerability (K17515)

The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service assertion failure via a 6 or mode 7 packet containing a long data value. CVE-2015-7855 Impact A locally authenticated user may be able to disrupt ntpd...

F5 Networks BIG-IP : Java SE vulnerabilities (SOL17079)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732. %NASLMINLEVEL 70300 C Tenable...

F5 Networks BIG-IP : Libpng vulnerability (K81903701)

Buffer overflow in the pngsetPLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a small...

F5 Networks BIG-IP : Linux libuser vulnerability (SOL05770600)

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service inconsistent file state by causing an error during the modification. NOTE: this issue can be combined wi...

F5 Networks BIG-IP : NTP vulnerability (K17525)

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service crash via a negative input value. CVE-2015-7853 Impact Running a custom refclock driver in ntpd could overflow a data...

Buffer Overflow Vulnerability in Multiple F5 BIG-IP and BIG-IQ Products

F5 BIG-IP LTM and others are products of F5 USA.LTM is a local traffic manager; BIG-IQ is a software-based cloud management solution. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid...