6005 matches found
Code injection
When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process...
CVE-2018-5536
A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server configured with an APM per-request policy object and cause a memory leak in the APM module...
CVE-2018-5531
The CVE affects F5 BIG-IP vCMP (host and guests). Vulnerable components are the vCMP guest and host systems running BIG-IP versions: 13.0.0–13.1.0.7, 12.1.0–12.1.3.5, 11.6.0–11.6.3.1, and 11.2.1–11.5.6. The root cause is unspecified methods that enable adjacent-network attackers (Layer 2) to trig...
CVE-2018-5541
CVE-2018-5541 affects F5 BIG-IP ASM (BD process) where processing HTTP requests with an unusually large number of parameters can cause excessive CPU usage, leading to a DoS. Affected versions include BIG-IP ASM 13.0.0–13.1.0.1, 12.1.0–12.1.3.5, 11.6.0–11.6.3.1, and 11.5.1–11.5.6. Mitigation is to...
CVE-2018-5537
A remote attacker may be able to disrupt services on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 if the TMM virtual server is configured with a HTML or a Rewrite profile. TMM may restart while processing some specially prepared HTML content from the back end...
CVE-2018-5530
CVE-2018-5530 affects F5 BIG-IP BIG-IP 11.6.x, 12.1.x, and 13.0–13.1.0.5 with HTTP/2 profiles enabled. The root cause is an HPACK Bomb in the data plane, causing abnormal memory consumption and potential DoS. Affected versions include 11.6.0–11.6.3.1, 12.1.0–12.1.3.5, and 13.0.0–13.1.0.5. Remedia...
CVE-2018-5539
Under certain conditions, on F5 BIG-IP ASM 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, 11.5.1-11.5.6, or 11.2.1, when processing CSRF protections, the BIG-IP ASM bd process may restart and produce a core file...
CVE-2018-5530
F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb"...
CVE-2018-5539
The CVE affects F5 BIG-IP ASM. Conditions when processing CSRF protections may cause the bd process to restart and write a core file, leaving the ASM unable to process traffic. Affected versions include 13.0.0–13.1.0.7, 12.1.0–12.1.3.5, 11.6.0–11.6.3.1, 11.5.1–11.5.6, and 11.2.1. Remediation per ...
CVE-2018-5542
F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server...
CVE-2018-5531
Through undisclosed methods, on F5 BIG-IP 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.2.1-11.5.6, adjacent network attackers can cause a denial of service for VCMP guest and host systems. Attack must be sourced from adjacent network layer 2...
CVE-2018-5538
On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable "dnsexpress.notifyport" is set to any value other than the...
CVE-2018-5542
CVE-2018-5542 affects F5 BIG-IP HTTPS health monitors (versions 13.0.0–13.0.1, 12.1.0–12.1.3.6, 11.2.1–11.6.3.2) that fail to validate the identity of the monitored server. The underlying design flaw allows an attacker with a privileged network position to potentially disclose/modify monitor traf...
CVE-2018-5537
CVE-2018-5537 affects F5 BIG-IP TMM when the TMM virtual server uses a HTML or Rewrite profile. Vulnerable: BIG-IP versions 11.2.1–11.5.6, 11.6.0–11.6.3.1, 12.1.0–12.1.3.5, and 13.0.0–13.1.0.5. Root cause: TMM restart during processing of specially prepared HTML from the back end. Impact: tempora...
CVE-2018-5536
CVE-2018-5536 affects F5 BIG-IP APM: a memory-leak vulnerability when a virtual server uses an APM per-request policy object. Affected are BIG-IP APM versions 13.0.0–13.1.0.7 and 12.1.0–12.1.3.5. Remediation per advisory involves upgrading to fixed versions: 13.1.0.8, 12.1.3.6, and 14.x (14.1.0)....
CVE-2018-5538
CVE-2018-5538 affects F5 BIG-IP DNS/DNS Express (13.1.0–13.1.0.7, 12.1.3–12.1.3.5). The root cause is that DNS Express/DNS Zones accept NOTIFY messages on the management interface from source addresses not in the Allow NOTIFY From list when the database key dnsexpress.notifyport is set to a value...
LocalTapiola: F5 BigIP Backend Cookie Disclosure
Basic report information Summary: The Same issue was reported on www.myynti.lahitapiolarahoitus.fi by another reporter. It was fixed for that. But when I test the same issue on lahitapiolarahoitus.fi. It is also causing leakage of information. Description: I just identify F5 BigIP load balancers...
Denial of service
On F5 BIG-IP 14.0.0, 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.5.1-11.6.3 specifically crafted HTTP responses, when processed by a Virtual Server with an associated QoE profile that has Video enabled, may cause TMM to incorrectly buffer response data causing the TMM to restart resulting in a Denial of...
CVE-2018-5532
On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 a domain name cached within the DNS Cache of TMM may continue to be resolved by the cache even after the parent server revokes the record, if the DNS Cache is receiving a stream of requests for the cached name...