6735 matches found
K000134670: Linux kernel vulnerability CVE-2022-2964
Security Advisory Description A flaw was found in the Linux kernel's driver for the ASIX AX88179178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. CVE-2022-2964 Impact There is no impact; F5 products are not...
K000133402: Apache Tomcat vulnerability CVE-2023-28708
Security Advisory Description When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 di...
K78530002: Java vulnerability CVE-2013-5803
Security Advisory Description Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via...
K14930: PHP vulnerability CVE-2011-4718
Security Advisory Description Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. CVE-2011-4718 Impact None Security Advisory Status To determine if your release is known to be vulnerable, the...
K98528405: BIG-IP BIND vulnerability CVE-2018-5740
Security Advisory Description A flaw in the "deny-answer-aliases" feature can cause an INSIST assertion failure in named. CVE-2018-5740 Impact A flaw in a rarely used BIND feature can cause an assertion failure in named. As a result, the bind process restarts. Security Advisory Status F5 Product...
K54200228: BIG-IP iRules vulnerability CVE-2020-5877
Security Advisory Description Malformed input to the DATAGRAM::tcp iRules command within a FLOWINIT event may lead to a denial of service. CVE-2020-5877 Impact Remote attackers may be able to perform a denial-of-service DoS attack on the BIG-IP system. Security Advisory Status F5 Product...
K15150: cURL and libcurl vulnerability CVE-2013-4545
Security Advisory Description cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST when the digital signature verification CURLOPTSSLVERIFYPEER is disabled, which allows man-in-the-middle attackers to spo...
K35815741: Intel CSME and TXE vulnerability CVE-2019-0086
Security Advisory Description Insufficient access control vulnerability in Dynamic Application Loader software for IntelR CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and IntelR TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local...
K20038622: Multiple Apache Tomcat vulnerabilities
Security Advisory Description CVE-2013-1976 The 1 tomcat5, 2 tomcat6, and 3 tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a...
K89434121: Linux kernel vulnerability CVE-2017-12193
Security Advisory Description The assocarrayinsertintoterminalnode function in lib/assocarray.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service NULL pointer dereference and panic via a crafted application, as demonstrated by the...
K34041353: Linux kernel vulnerability CVE-2021-38202
Security Advisory Description fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service out-of-bounds read in strlen by sending NFS traffic when the trace event framework is being used for nfsd. CVE-2021-38202 Impact There is no impact; F5 product...
K87141725: BIG-IP APM redirect vulnerability CVE-2017-0302
Security Advisory Description Insufficient boundary checks on the request URL may cause the tmm process to assert when the user is redirected back to the original request URL following successful authentication to the BIG-IP APM system. CVE-2017-0302 Impact An authenticated user with an establish...
K44885536: iControl REST vulnerability CVE-2019-6622
Security Advisory Description Undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems. The vulnerability allows bypass of Appliance mode security on BIG-IP systems by allowing t...
K52513065: BinUtils vulnerabilities CVE-2018-6759 and CVE-2018-6872
Security Advisory Description CVE-2018-6759 The bfdgetdebuglinkinfo1 function in opncls.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service...
K15956: Linux kernel vulnerability CVE-2014-2568
Security Advisory Description Use-after-free vulnerability in the nfqnlzcopy function in net/netfilter/nfnetlinkqueuecore.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the...
K8280: Cross-site scripting vulnerabilities in BIG-IP Configuration utility CVE-2008-0265
Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...
K52013062: Ansible Engine vulnerability CVE-2020-14365
Security Advisory Description A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the...
K17386: vCMP DoS vulnerability CVE-2015-6546
Security Advisory Description An attacker sourcing malicious traffic from a network adjacent to the BIG-IP system may be able to cause a denial-of-service DoS condition on a vCMP host and the vCMP guests running on it. The vulnerability cannot be exploited outside of the local network segment or ...
K16505: NTP vulnerability CVE-2015-1798
Security Advisory Description The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...
K3082: Multiple vulnerabilities in OpenSSL - CAN-2004-0081, CAN-2004-0079, CAN-2004-0112
Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...
K17563: Apache Struts vulnerability CVE-2015-2992
Security Advisory Description Arbitrary script can be executed when JSP files are exposed to be accessed directly. Affected versions are Struts 2.0.0 - 2.3.16.3. CVE-2015-2992 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product...
K07051153: TMUI vulnerability CVE-2020-5905
Security Advisory Description In the BIG-IP Configuration utility Network WCCP page, the system does not sanitize all user-provided data before displaying the page. CVE-2020-5905 Impact Authenticated administrative users with access to this page in the Configuration utility may inject code onto t...
K15922322: MySQL vulnerability CVE-2016-8288
Security Advisory Description Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin. CVE-2016-8288 Impact There is no impact; F5 products are not affected by this...
K03551138: MySQL vulnerabilities CVE-2018-2817, CVE-2018-2818, CVE-2018-2819, CVE-2018-2839, and CVE-2018-2846
Security Advisory Description CVE-2018-2817 Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DDL. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with...
K15885: GNU C Library vulnerability CVE-2011-1071
Security Advisory Description The GNU C Library aka glibc or libc6 before 2.12.2 and Embedded GLIBC EGLIBC allow context-dependent attackers to execute arbitrary code or cause a denial of service memory consumption via a long UTF8 string that is used in an fnmatch call, aka a "stack extension...
K1907: mod_ssl and Apache_SSL buffer overflow - CAN-2002-0082
Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...
K16285: OpenSSL vulnerability CVE-2012-2110
Security Advisory Description The asn1d2ireadbio function in crypto/asn1/ad2ifp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service memory...
K8837: OpenSSL DTLS off-by-one error - CVE-2007-4995
Security Advisory Description Note : Versions that are not listed in this Solution have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the ...
K23520761: BIG-IP ASM and BIG-IP AFM/BIG-IP Analytics vulnerability CVE-2018-5505
Security Advisory Description On F5 BIG-IP 13.1.0 - 13.1.0.3, when ASM and one or more of these modules AFM/AVR are provisioned, the Traffic Management Microkernel TMM may restart while processing DNS requests when the virtual server is configured with a DNS profile and the Protocol setting is se...
K68942513: Java vulnerability CVE-2013-5780
Security Advisory Description Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via...
K10631282: Flip Feng Shui (FFS) vulnerability
Security Advisory Description Flip Feng Shui FFS a new exploitation vector that allows an attacker to induce bit flips over arbitrary physical memory in a fully controlled way. FFS relies on the following underlying primitives: The ability to induce bit flips in controlled but not predetermined...
K36228121: BIG-IP DHCPv6 vulnerability CVE-2019-6643
Security Advisory Description An attacker sending specifically crafted DHCPv6 requests through a BIG-IP virtual server configured with a DHCPv6 profile may be able to cause the Traffic Management Microkernel TMM process to produce a core file. CVE-2019-6643 Impact This vulnerability may allow an...
K44453423: IP-in-IP Packet Processing vulnerability CVE-2020-10136
Security Advisory Description Multiple products that implement the IP Encapsulation within IP standard RFC 2003, STD 1 decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface an...
K42142782: Linux kernel vulnerability CVE-2017-15121
Security Advisory Description A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary. CVE-2017-15121 Impact An attacker can exploit this vulnerability to cause a denial of...
K45816067: bzip2 vulnerability CVE-2016-3189
Security Advisory Description Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service crash via a crafted bzip2 file, related to block ends set to before the start of the block. CVE-2016-3189 Impact There is no impact; F5 products are not...
K21057235: libpng out-of-bounds read vulnerability CVE-2015-7981
Security Advisory Description The pngconverttorfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds...
K50112422: Linux kernel vulnerability CVE-2020-11884
Security Advisory Description In the Linux kernel through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enablesacfuaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. ...
K03685068: Linux kernel vulnerability CVE-2017-5972
Security Advisory Description The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service CPU consumption by sending many TCP SYN packets, as demonstrated ...
K41020865: MySQL vulnerability CVE-2016-8286
Security Advisory Description Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges. CVE-2016-8286 Impact There is no impact; F5 products are not affected by this vulnerability...
K35750231: TMM vulnerability CVE-2020-5878
Security Advisory Description Traffic Management Microkernel TMM may restart on BIG-IP Virtual Edition VE while processing unusual IP traffic. CVE-2020-5878 Impact The BIG-IP VE system may temporarily fail to process traffic as it recovers from a TMM restart. If the BIG-IP VE system is configured...
K14560101: Wget vulnerability CVE-2019-5953
Security Advisory Description Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service DoS or may execute an arbitrary code via unspecified vectors. CVE-2019-5953 Impact There is no impact; F5 products are not affected by this vulnerability. Security...
K16356: BIND vulnerability CVE-2015-1349
Security Advisory Description named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service assertion failure and daemon exit, or daemon crash by triggering a...
K12671141: Linux kernel vulnerability CVE-2019-8956
Security Advisory Description In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctpsendmsg" function net/sctp/socket.c when handling SCTPSENDALL flag can be exploited to corrupt memory. CVE-2019-8956 Impact There is no impact; F5 products are not affected by...
K21042153: XSS vulnerability in undisclosed TMUI page CVE-2018-15313
Security Advisory Description A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15313 Impact BIG-IP A remote unauthenticated...
K37428370: Intel Xeon access control vulnerability CVE-2019-0126
Security Advisory Description Insufficient access control in silicon reference firmware for IntelR XeonR Scalable Processor, IntelR XeonR Processor D Family may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access. CVE-2019-0126 Impact Th...
K37890841: BIG-IP APM logging disclosure vulnerability CVE-2019-19150
Security Advisory Description The BIG-IP APM system logs the client-session-id when a per-session policy is attached to the virtual server with debug logging enabled. CVE-2019-19150 Impact The BIG-IP APM system logs the client-session-id in the log files and is available to authenticated...
K62695363: OpenSSL vulnerability CVE-2018-0733
Security Advisory Description Because of an implementation bug the PA-RISC CRYPTOmemcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than th...
K35255309: Linux kernel vulnerability CVE-2020-11669
Security Advisory Description An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idlebook3s.S does not have save/restore functionality for PNVPOWERSAVEAMR, PNVPOWERSAVEUAMOR, and PNVPOWERSAVEAMOR, aka CID-53a712bae5dd. CVE-2020-11669 Impact There i...
K52420610: Advanced WAF and BIG-IP ASM TMUI vulnerability CVE-2021-23029
Security Advisory Description Insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery SSRF attacks through F5 Advanced Web Application Firewall WAF and the BIG-IP ASM Configuration utility. CVE-2021-23029 Impact An attacker with...
K94941221: TMM SCTP vulnerability CVE-2021-23045
Security Advisory Description When an SCTP profile with multiple paths is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2021-23045 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allows a remo...