PT-2015-6396

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 12.0.0 Enterprise Manager versions 3.0.0 through 3.1.1 Description A directory traversal issue exists in the configuration utility, allowing remote authenticated users to access arbitrary files in the web root...

F5 Networks BIG-IP : GNU C Library vulnerability (SOL16435)

GNU C Library aka glibc before 2.20 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via a multibyte character value of '0xffff' to the iconv function when converting 1 IBM933, 2 IBM935, 3 IBM937, 4 IBM939, or 5 IBM1364 encoded data to UTF-8. C Tenable...

F5 Networks BIG-IP : Multiple unzip vulnerabilities (SOL16480)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. C Tenable Network Security, Inc. The descriptive text and package check...

F5 Networks BIG-IP : Linux kernel vulnerability (SOL16122)

arch/x86/kernel/entry64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment SS segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space. C Tenabl...

F5 Networks BIG-IP : Boost memory allocator vulnerability (K16946)

Integer overflow in the orderedmalloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected...

F5 Networks BIG-IP : Apache vulnerability (SOL15902)

Memory leak in the aprbrigadesplitline function in buckets/aprbrigade.c in the Apache Portable Runtime Utility library aka APR-util before 1.3.10, as used in the modreqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service memory...

F5 Networks BIG-IP : PHP vulnerability (SOL16826)

Algorithmic complexity vulnerability in the multipartbufferheaders function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service CPU consumption via crafted form data that triggers an improper order-of-growth...

F5 BIG-IP 10.1.0 - Directory Traversal Vulnerability

Affected Product : F5 BIG-IP Vendor Homepage : http://www.f5.com/ Version : 10.1.0 Vulnerability Category : Local vulnerability Discovered by : Anastasios Monachos secuid0 - anastasiosm at gmail dot com CVE : CVE-2014-8727 Patched : Yes An authenticated user with either "Resource Administrator" o...

F5 Networks BIG-IP : Perl vulnerabilities (K15867)

CVE-2012-5195 Heap-based buffer overflow in the Perlrepeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service memory consumption and crash or possibly execute arbitrary code via the 'x...

F5 Networks BIG-IP : Apache Tomcat vulnerability (SOL16344)

ava/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks ...

F5 Networks BIG-IP : D-Bus vulnerability (SOL17256)

The busconnectionscheckreply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service CPU consumption via a large number of method calls. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

F5 Networks BIG-IP : Java Runtime Environment vulnerability (SOL16872)

Unspecified vulnerability in the Java Runtime Environment JRE in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 allows remote attackers to affect availability via unknown vectors. C Tenable Network Security, Inc. The descriptive text and package chec...

F5 Networks BIG-IP : logrotate vulnerability (SOL16869)

Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

F5 Networks BIG-IP : SUSE coreutils vulnerabilities (SOL16859)

The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service segmentation fault and crash via a long string to the sort command, when using the 1 -d or 2 -M switch, which triggers a stack-based buffer overflow in the alloca function. C Tenable...

F5 Networks BIG-IP : OpenSSL vulnerability (K17248)

The Cryptographic Message Syntax CMS implementation in crypto/cms/cmsasn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, a...

F5 Networks BIG-IP : Linux kernel SCTP vulnerability (K17242)

Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service slab corruption and panic or possibly have unspecified other impact by triggering an INIT collision that leads to improper...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K17253)

Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors. CVE-2015-4040 Impact An authenticated user is able to traverse...

F5 Networks BIG-IP : TMM vulnerability (K17155)

The Traffic Management Microkernel TMM may restart and produce a core file when a FastL4 virtual server processes a fragmented packet. CVE-2015-4638 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution K17155. The...

F5 Networks BIG-IP : Linux kernel vulnerability (SOL17199)

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service system disruption by...

F5 Networks BIG-IP : Node.js vulnerability (SOL17238)

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a deni...