Remote file inclusion

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5522

On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash...

CVE-2018-5523

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on...

CVE-2018-5522

On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash...

Design/Logic Flaw

Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an iRule, or via the inflate code from PEM module are subjected to a service disruption via a "Zip Bomb" attack...

CVE-2018-5525

A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that exposes files containing F5-provided data only and do not include any configuration data, proxied traffic, or other potentially sensitive...

CVE-2018-5522

On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pairs, TMM may crash...

CVE-2018-5521

CVE-2018-5521 affects F5 BIG-IP platforms with GeoIP2 logic. The root cause is reflection of crafted URLs into GeoIP lookup responses, enabling cross-site scripting (XSS) on affected clients. Affected BIG-IP versions include 12.1.0–12.1.3.1, 11.6.1–11.6.3.1, 11.5.1–11.5.5, and 11.2.1. The officia...

CVE-2018-5526

The vulnerability CVE-2018-5526 affects F5 BIG-IP ASM (Application Security Manager) where Behavioral DoS (BADoS) protection may fail under attack. Affected releases include BIG-IP ASM 13.1.0 through 13.1.0.5; the advisory indicates fixes were introduced in 13.1.0.6 (and related updates) and list...

CVE-2017-6153

CVE-2017-6153 affects F5 BIG-IP inflating/PEM module code used via iRules or PEM, enabling a Zip Bomb-induced data-plane disruption. Affected: BIG-IP 13.0.0–13.1.0.3, 12.1.0–12.1.3.1, 11.6.x, 11.5.x, 11.2.1. Fixed in 13.1.0.4; 12.1.3.2; 11.6.3.2 (and 11.5.6); other 11.x paths vary per version tab...

CVE-2018-5525

The CVE-2018-5525 issue affects F5 BIG-IP Configuration utility. A local-file vulnerability may allow authenticated users to retrieve files local to the BIG-IP system that contain only F5-provided data (not configuration data or customer data). Affected versions include BIG-IP 13.0.0, 12.1.0–12.1...

CVE-2018-5522

CVE-2018-5522 affects F5 BIG-IP TMM when processing DIAMETER transactions with crafted attribute-value pairs, potentially causing TMM to crash or restart. Affected releases include BIG-IP 13.0.0; 12.0.0–12.1.2; 11.6.1–11.6.3.1; 11.5.1–11.5.5; and 11.2.1. The vulnerability stems from how DIAMETER ...

CVE-2017-6153

Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an iRule, or via the inflate code from PEM module are subjected to a service disruption via a "Zip Bomb" attack...

CVE-2018-5513

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crash leading to a disruption of service. This issue is only exposed on the data plane when Proxy SSL configuration is enabled. The control plane is not impact...

CVE-2018-5524

Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL or Server SSL profiles which make use of network hardware security module HSM functionality are exposed and impacted by this issue...

CVE-2018-5521

On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup responses, potentially exposing clients to XSS...

CVE-2018-5513

CVE-2018-5513 affects F5 BIG-IP TMM when Proxy SSL is enabled on the data plane. A malformed TLS handshake crashes or stalls TMM, causing disruption of service; the control plane remains unaffected. Connected advisory details specify vulnerable branches and the fixes: BIG-IP versions 13.0.0 and 1...

CVE-2018-5526

Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS BADOS protection may fail during an attack...

CVE-2018-5523

On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility, restrictions on...