PT-2014-8945

Name of the Vulnerable Software and Affected Versions F5 BIG-IP version 11.3.0 Description A cross-site scripting XSS issue exists in the tree view feature of Application Security Manager ASM due to insufficient validation of user input. This allows remote attackers to inject arbitrary web script...

CVE-2014-9342: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the tree view pltree.php feature in Application Security Manager ASM in F5 BIG-IP 11.3.0 allows remote attackers to inject arbitrary web script or HTML by accessing a crafted URL during automatic policy generation...

SOL15882 - TLS1.x padding vulnerability CVE-2014-8730

2 If you are planning to upgrade to BIG-IP APM 11.4.1 HF6 or 11.5.1 HF6 to mitigate this issue, you should instead upgrade to 11.4.1 HF7 or 11.5.1 HF7 to avoid an issue specific to BIG-IP APM. For more information, refer to SOL15914: The TMM process may restart and produce a core file after...

F5 Networks BIG-IP : Apache HTTP server vulnerabilities (SOL15889)

The modproxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to...

F5 Networks BIG-IP : libxml2 vulnerability (SOL15872)

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service CPU consumption via a crafted XML document containing a large number of nested entity references, a...

F5 Networks BIG-IP : Apache Tomcat vulnerability (SOL15428)

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a...

F5 Networks BIG-IP : PHP vulnerability (SOL15876)

Heap-based buffer overflow in the phpquotprintencode function in ext/standard/quotprint.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted argument to the quotedprintableenco...

SOL15876 - PHP vulnerability CVE-2013-2110

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version...

F5 Networks BIG-IP : Libpng vulnerability (SOL15881)

The pngsettext2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocati...

F5 Networks BIG-IP : Net-SNMP vulnerability (K15883)

Array index error in the handlensExtendOutput2Table function in agent/mibgroup/agent/extend.c in Net-SNMP 5.7.1 allows remote authenticated users to cause a denial of service out-of-bounds read and snmpd crash via an SNMP GET request for an entry not in the extension table. CVE-2012-2141 C Tenabl...

F5 Networks BIG-IP : GNU C Library vulnerability (SOL15885)

The GNU C Library aka glibc or libc6 before 2.12.2 and Embedded GLIBC EGLIBC allow context-dependent attackers to execute arbitrary code or cause a denial of service memory consumption via a long UTF8 string that is used in an fnmatch call, aka a 'stack extension attack,' a related issue to...

F5 Networks BIG-IP : cURL vulnerability (SOL15875)

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. CVE-2013-1944 C Tenable Network Security, Inc. The descriptive text and...

F5 Networks BIG-IP : bzip2 vulnerability (SOL15878)

Integer overflow in the BZ2decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted compressed file. C Tenable Network Security, Inc. The descriptive te...

F5 Networks BIG-IP : Linux kernel vulnerability (SOL15852)

The trytounmapcluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service system crash by triggering a memory-usage pattern that requires removal of page-table mappings. C Tenable...

CVE-2014-8727

Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. dot dot in the name parameter to 1 tmui/Control/jspmap/tmui/system/archive/properties.jsp or 2...

Directory traversal

Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. dot dot in the name parameter to 1 tmui/Control/jspmap/tmui/system/archive/properties.jsp or 2...

CVE-2014-8727

CVE-2014-8727 affects F5 BIG-IP before 10.2.2. The vulnerability is a directory traversal flaw in the properties.jsp and tmui/form paths that an authenticated Resource Administrator or Administrator can use to enumerate and delete arbitrary files (e.g., via .. in the name parameter). Impact is th...

CVE-2014-8727

Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. dot dot in the name parameter to 1 tmui/Control/jspmap/tmui/system/archive/properties.jsp or 2...

PT-2014-8692

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 10.2.2 Description The issue allows local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files. This is achieved by exploiting directory traversal vulnerabilities...

CVE-2014-8727: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrator" or "Administrator" role to enumerate and delete arbitrary files via a .. dot dot in the name parameter to 1 tmui/Control/jspmap/tmui/system/archive/properties.jsp or 2...