K64552448: SSL forward proxy vulnerability CVE-2018-5534

Security Advisory Description Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, 12.1.0-12.1.3.1, 11.6.0-11.6.3.1, or 11.5.0-11.5.6, TMM may core while processing SSL forward proxy traffic. CVE-2018-5534 Impact This vulnerability may allow a remote attacker to cause the Traffic...

K66510514: TMM vulnerability CVE-2022-34862

Security Advisory Description When an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2022-34862 Impact This vulnerability affects systems with one or more of the following configurations. Affected...

K16383: Linux RPM vulnerability CVE-2013-6435

Security Advisory Description Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d...

K52534925: BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203

Security Advisory Description When a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. CVE-2022-33203 Impact System performance can degrade until the Traffic Management Microkernel TMM...

K35236639: Supermicro BMC vulnerability

Security Advisory Description F5 is aware of the reports of vulnerabilities in the baseband management controllers BMCs of Supermicro servers. These vulnerabilities allow attackers to easily connect to a server and virtually mount any USB device to the server, remotely over any network, including...

K16904: OpenSSL ssleay_rand_byte(s) regression CVE-2015-3216

Security Advisory Description Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleayrandbytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux RHEL 7 and other products, allows remote attackers to cause a denial of service...

K49160100: Apache Tomcat vulnerability CVE-2016-6817

Security Advisory Description The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible. CVE-2016-6817 Impact There is no impact; F5...

K92140924: F5 management sshd vulnerability CVE-2017-6128

Security Advisory Description An undisclosed traffic pattern received on an F5 management interface may cause the Secure Shell Daemon sshd to stop responding, resulting in a Denial-of-Service DoS. CVE-2017-6128 Impact An attacker may be able to cause a denial-of-service DoS attack against the ssh...

K6804: ClamAV Portable Executable heap overflow Vulnerability - CVE-2006-4182

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

K03310902: Multiple Linux vulnerabilities CVE-2020-8647,CVE-2020-8648, CVE-2020-8649

Security Advisory Description CVE-2020-8647 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vcdoresize function in drivers/tty/vt/vt.c. CVE-2020-8648 There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the nttyreceivebufcommon function in...

K75042242: QEMU 4.0 vulnerability CVE-2019-12155

Security Advisory Description interfacereleaseresource in hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer dereference. CVE-2019-12155 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the currently...

K9108: Apache Tomcat Cross-site scripting (XSS) vulnerability - CVE-2008-1232

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

K16990: zlib 1.2.2 vulnerability CVE-2005-1849

Security Advisory Description inftrees.h in zlib 1.2.2 allows remote attackers to cause a denial of service application crash via an invalid file that causes a large dynamic tree to be produced. CVE-2005-1849 Impact None. F5 products are not affected by this vulnerability. Security Advisory Statu...

K12853: OpenSSL vulnerability CVE-2008-7270

Security Advisory Description Note : For information about signing up to receive security notice updates from F5, refer to K9970: Subscribe to email notifications regarding F5 products and security announcements. Note : F5 has not evaluated specific versions that are not listed in this article fo...

K44164245: XSS vulnerability CVE-2013-2618

Security Advisory Description Cross-site scripting XSS vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inject arbitrary web script or HTML via the maptitle parameter. CVE-2013-2618 Impact There is no impact; F5 products are not affected by this...

K41503304: Advanced WAF, BIG-IP ASM, and NGINX App Protect attack signature bypass security exposure

Security Advisory Description The F5 Advanced Web Application Firewall Advanced WAF, BIG-IP ASM, and NGINX App Protect systems attack signature check may fail to match attack signature 200000128, as expected, for certain undisclosed requests. This issue occurs when all of the following conditions...

K15689: Fine Free file vulnerabilites CVE-2014-1943 and CVE-2014-2270

Security Advisory Description CVE-2014-1943 Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service infinite recursion, CPU consumption, and crash via a crafted indirect offset value in the magic of a file. CVE-2014-2270 softmagic.c in file before 5.17 and...

K16883: TCP sequence number vulnerability CVE-1999-0077

Security Advisory Description Predictable TCP sequence numbers allow spoofing. CVE-1999-0077 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status To determine if your release is known to be vulnerable, the components or features that are affected...

K12543: OpenSSL vulnerability CVE-2010-4180

Security Advisory Description Note : For information about signing up to receive security notice updates from F5, refer to K9970: Subscribe to email notifications regarding F5 products and security announcements. Note : Versions that are not listed in this article have not been evaluated for...

K16882: OpenLDAP vulnerability CVE-2013-4449

Security Advisory Description Description The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service slapd crash by unbinding immediately after a search request, which triggers rwmconndestroy to free the...