K37155600: BIG-IP RTSP profile vulnerability CVE-2022-28691

Security Advisory Description When a Real Time Streaming Protocol RTSP profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Microkernel TMM resource utilization. CVE-2022-28691 Impact System performance can degrade until the process is either...

K10550253: ImageMagick vulnerability CVE-2016-3715

Security Advisory Description The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. CVE-2016-3715 Note : This vulnerability is one of the series of vulnerabilities known as ImageTragick. Impact Exploiting...

K17254: NTP-keygen vulnerability CVE-2015-3405

Security Advisory Description flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. CVE-2015-3405 - pending Impact There...

K17251: Apache vulnerability CVE-2015-3183

Security Advisory Description The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values...

K81903701: Libpng vulnerability CVE-2015-8472

Security Advisory Description Buffer overflow in the pngsetPLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service application crash or possibly have...

K16838: XSS vulnerability in the BIG-IP and Enterprise Manager Configuration utilities CVE-2015-1470

Security Advisory Description Using the BIGIPAuthUsernameCookie value with/tmui/login.jsp can expose a cross-site scripting XSS security flaw. CVE-2015-1470 Impact Some login.jsp parameters may allow an attacker to bypass XSS protection mechanisms by using a crafted cookie. Security Advisory Stat...

K15159: OpenSSL vulnerability CVE-2014-0160

Security Advisory Description The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as...

K16837: tcpdump before 4.7.2 vulnerabilities CVE-2015-0261, CVE-2015-0261, CVE-2015-2153, CVE-2015-2154, CVE-2015-2155

Security Advisory Description Description CVE-2015-0261 Integer signedness error in the mobilityoptprint function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service out-of-bounds read and crash or possibly execute arbitrary code via a negativ...

K61974123: ImageMagick vulnerability CVE-2016-3718

Security Advisory Description The 1 HTTP and 2 FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery SSRF attacks via a crafted image. CVE-2016-3718 Note : This vulnerability is one of the series of vulnerabilities known as...

K25102203: ImageMagick vulnerability CVE-2016-3716

Security Advisory Description The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image. CVE-2016-3716 Note : This vulnerability is one of the series of vulnerabilities known as ImageTragick. Impact Exploiting this...

K12002065: BIG-IP ASM XSS vulnerability CVE-2020-5932

Security Advisory Description A cross-site scripting XSS vulnerability exists in the BIG-IP ASM Configuration utility response and blocking pages. An authenticated user with administrative privileges can specify a response page with any content, including JavaScript code that will be executed whe...

K22493037: The BIG-IP ASM system sends a received XML request with sensitive payload to the ICAP server

Security Advisory Description The BIG-IP ASM system sends a received XML request with sensitive payload to the Internet Content Adaptation Protocol ICAP server for inspection, regardless of any other settings. This issue occurs when all of the following conditions are met: The affected security...

K04160444: Intel CPU vulnerability CVE-2020-0592

Security Advisory Description Out of bounds write in BIOS firmware for some IntelR Processors may allow an authenticated user to potentially enable escalation of privilege and/or denial of service via local access. CVE-2020-0592 Impact There is no impact; F5 products are not affected by this...

K02705117: The BIG-IP ASM system may fail to properly mask the value of a configured sensitive parameter in the request event log

Security Advisory Description When you configure a sensitive parameter for a security policy, the BIG-IP ASM system may fail to properly mask the value in the request log. This issue occurs when all of the following conditions are met: You enabled the Cross-Site Request Forgery CSRF Protection...

K16970: TLS Finish Message vulnerability

Security Advisory Description The BIG-IP system does not verify every byte in the Finished message of a TLS handshake. Impact There is no impact; F5 does not consider this behavior a vulnerability. Security Advisory Status F5 Product Development has assigned ID 530963 to this issue, and has...

K26583415: MQTT vulnerability CVE-2018-15323

Security Advisory Description In certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action. CVE-2018-15323 Impact This vulnerability allows remote attackers to cause a...

K83093212: The BIG-IP ASM system may stop enforcing attack signatures after applying a security policy that includes a new signature

Security Advisory Description This issue occurs when all of the following conditions are met: Your BIG-IP ASM system is running versions 12.1.2 through 12.1.3.6. You configure multiple security policies on the BIG-IP ASM system. One of the security policies includes a new attack signature not...

K64124988: TMM IPv6 stack vulnerability CVE-2022-29479

Security Advisory Description When an IPv6 self IP address is configured and the ipv6.strictcompliance database key is enabled disabled by default on a BIG-IP system, undisclosed packets may cause decreased performance.CVE-2022-29479 Impact This vulnerability allows an unauthenticated attacker to...

K54431371: BIG-IP APM client for Linux and macOS vulnerability CVE-2018-5546

Security Advisory Description The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. CVE-2018-5546 Impact A...

K36228121: BIG-IP DHCPv6 vulnerability CVE-2019-6643

Security Advisory Description An attacker sending specifically crafted DHCPv6 requests through a BIG-IP virtual server configured with a DHCPv6 profile may be able to cause the Traffic Management Microkernel TMM process to produce a core file. CVE-2019-6643 Impact This vulnerability may allow an...