Code injection

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners primary and/or secondary IP may...

CVE-2017-6151

CVE-2017-6151 affects F5 BIG-IP software (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe) version 13.0.0 where virtual servers using the HTTP/2 profile may cause disruption of TMM. Root cause: undisclosed requests to HTTP/2-enabled virtua...

CVE-2017-6138

CVE-2017-6138 affects F5 BIG-IP software (LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe) versions 13.0.0 and 12.1.0–12.1.2. Malicious requests to virtual servers with an HTTP profile can cause TMM restart; APM profiles are affected regardless of settings, and non-def...

CVE-2017-6135

CVE-2017-6135 affects F5 BIG-IP software (LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe) version 13.0.0. The issue is a slow memory leak caused by undisclosed IPv4/IPv6 packets sent to the BIG-IP management port or self IP addresses, which can lead to out-of-memory (...

CVE-2017-6133

In F5 BIG-IP, the CVE-2017-6133 vulnerability affects BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe with versions 13.0.0 and 12.1.0–12.1.2. The issue arises from an undisclosed HTTP request handling flaw in the Traffic Management Microkernel (TMM), leading to de...

CVE-2017-6132

CVE-2017-6132 affects F5 BIG-IP LTM and multiple modules (AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, WebSafe) across versions 11.5.0–11.5.4, 11.6.0–11.6.1, 12.0.0–12.1.2, and 13.0.0. The issue stems from an undisclosed sequence of packets sent to HA mirror listeners that may c...

CVE-2017-6138

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of...

CVE-2017-6167

CVE-2017-6167 is a race-condition vulnerability in F5 BIG-IP iControl REST that can cause commands to execute with elevated privileges. Affected BIG-IP versions include 13.x (13.0.0), 12.x (12.1.0–12.1.2), 14.x (14.1.x), 15.x (15.0–15.1.1/2), and 16.x (16.0.0–16.0.1). Red Hat and F5 advisories co...

CVE-2017-6134

The vulnerability CVE-2017-6134 affects F5 BIG-IP BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe across 11.x, 12.x, and 13.x branches. An undisclosed sequence of packets from an adjacent network can cause the Traffic Management Microkernel (TMM) to crash, po...

CVE-2017-6133: Improper Input Validation

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service...

PEM module heap overflow vulnerability in multiple Huawei products

Huawei DP300, IPS Module, and NGFW Module are all products of Huawei China. A heap overflow vulnerability exists in the PEM module of multiple Huawei products, which can be exploited by an authenticated local attacker to launch a denial-of-service attack by constructing a malicious certificate th...

PEM module null pointer access vulnerability in multiple Huawei products

Huawei DP300, IPS Module, and NGFW Module are all products of Huawei China. A null pointer access vulnerability exists in the PEM module of multiple Huawei products, which can be exploited by an authenticated local attacker to cause a denial-of-service attack by calling the PEM decoder with...

Memory Out-of-Bounds Access Vulnerability in PEM Module for Multiple Huawei Products

Huawei DP300, IPS Module, and NGFW Module are all products of Huawei China. The memory out-of-bounds access vulnerability in the PEM Module of several Huawei products can be exploited by an authenticated local attacker to launch a denial-of-service attack by constructing a malicious certificate...

PEM module denial of service vulnerability in multiple Huawei products

Huawei DP300, IPS Module, and NGFW Module are all products of Huawei China. A denial of service vulnerability exists in the PEM module of multiple Huawei products, which can be exploited by an authenticated local attacker to launch a denial of service attack by constructing a malicious certificat...

Security Advisory - Multiple Vulnerabilities of PEM Module in Some Huawei Products

There is a null pointer reference vulnerability in PEM module of Huawei products due to insufficient verification. An authenticated local attacker calls PEM decoder with special parameter, which could cause a denial of service. Vulnerability ID: HWPSIRT-2017-06047 This vulnerability has been...

Tor Denial of Service Vulnerability (CNVD-2017-38232)

Tor The Onion Router is a second-generation implementation of onion routing, primarily used for anonymous access to the Internet. Tor suffers from a denial of service vulnerability. An attacker can exploit this vulnerability to cause a denial of service application hang with specially crafted PEM...

CVE-2017-8821

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service application hang via crafted PEM input that signifies a public key requiring a password, which triggers an attempt by the...

CVE-2017-8821

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service application hang via crafted PEM input that signifies a public key requiring a password, which triggers an attempt by the...

DEBIAN-CVE-2017-8821

In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service application hang via crafted PEM input that signifies a public key requiring a password, which triggers an attempt by the...

CVE-2017-8821

CVE-2017-8821 in Tor allows an attacker to cause the application to ask for a password by sending crafted PEM input signaling a public key requiring a password, triggering OpenSSL to prompt. Affected releases include Tor up to 0.3.0.12 and 0.3.1 before 0.3.1.9 (also older 0.2.x series as listed i...