K25092613: rsyslog vulnerability CVE-2018-1000140

Security Advisory Description rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigg...

K04712583: Linux kernel vulnerability CVE-2021-40490

Security Advisory Description A race condition was discovered in ext4writeinlinedataend in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13. CVE-2021-40490 Impact An attacker may be able to access shared resources by way of untrusted code sequences. Security Advisory...

K91158923: BIG-IP SSL/TLS ADH/DHE vulnerability CVE-2020-5929

Security Advisory Description BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a virtual server configured with a Client SSL profile, and using Anonymous Diffie-Hellman ADH or Ephemeral Diffie-Hellman DHE key exchange and Single DH use option not enabled in the options list ma...

K01701871: Linux kernel vulnerability CVE-2016-5728

Security Advisory Description Race condition in the vopioctl function in drivers/misc/mic/vop/vopvringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service memory corruption and system crash by...

K90305959: Intel processor diagnostic tool vulnerability CVE-2019-11133

Security Advisory Description Improper access control in the IntelR Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access. CVE-2019-11133 Impact There is no...

K44462254: Reflected Cross-Site Scripting (XSS) vulnerability CVE-2018-15312

Security Advisory Description A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15312 Impact A remote unauthenticated attacker...

K61757346: BIG-IP Azure cloud vulnerability CVE-2017-6131

Security Advisory Description In some circumstances, a BIG-IP Azure cloud instance may contain a default administrative password which can be used to remotely log in to the BIG-IP system. The affected administrative account is the Azure instance administrative user created at deployment. The root...

K08476614: BIG-IP Client SSL profile vulnerability CVE-2022-23015

Security Advisory Description When a Client SSL profile is configured on a virtual server with Client Certificate Authentication set to request/require and Session Ticket enabled and configured, processing SSL traffic can cause an increase in memory resource utilization. CVE-2022-23015 Impact...

K87659521: Appliance mode tmsh vulnerability CVE-2019-6615

Security Advisory Description On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roles might exploit TMSH access to bypass Appliance Mode restrictions on BIG-IP systems. CVE-2019-6615 Impact Attackers can gain...

K27391542: BIG-IP APM per-request policy object vulnerability CVE-2018-5536

Security Advisory Description A remote attacker through undisclosed measures, may be able to exploit a virtual server configured with a BIG-IP APM per-request policy object and cause a memory leak in the BIG-IP APM module. CVE-2018-5536 Impact This vulnerability allows a disruption of service...

K16124204: procps-ng vulnerability CVE-2018-1124

Security Advisory Description procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in...

K20281756: Libgcrypt vulnerability CVE-2017-7526

Security Advisory Description libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately mo...

K50928877: Linux kernel vulnerability CVE-2020-12654

Security Advisory Description An issue was found in Linux kernel before 5.5.4. mwifiexretwmmgetstatus in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591. CVE-2020-12654 Impact There is no...

K07112184: HHVM vulnerability CVE-2016-1000109

Security Advisory Description HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI...

K14614344: libxml2 vulnerability CVE-2016-1840

Security Advisory Description Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of...

K60130614: Linux kernel vulnerability CVE-2019-19069

Security Advisory Description A memory leak in the fastrpcdmabufattach function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service memory consumption by triggering dmagetsgtable failures, aka CID-fc739a058d99. CVE-2019-19069 Impact An attacker...

K13523672: Linux kernel vulnerability CVE-2019-12454

Security Advisory Description DISPUTED An issue was discovered in wcd9335codecenabledec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdupnul, which allows attackers to have an unspecified impact via unknown vectors. NOTE: The vendor disputes this...

K94133434: Wireshark vulnerability CVE-2018-19627

Security Advisory Description In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by adjusting a buffer boundary. CVE-2018-19627 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisor...

K00265182: Custom monitor privilege escalation vulnerability CVE-2016-5020

Security Advisory Description F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification EAV monitor script. CVE-2016-5020 Impact An...

K19634255: TMM vulnerability CVE-2018-5535

Security Advisory Description On F5 BIG-IP, specifically crafted HTTP responses, when processed by a Virtual Server with an associated QoE profile that has Video enabled, may cause TMM to incorrectly buffer response data causing the TMM to restart resulting in a Denial of Service. CVE-2018-5535...

K73337338: Linux kernel vulnerability CVE-2017-16648

Security Advisory Description The dvbfrontendfree function in drivers/media/dvb-core/dvbfrontend.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service use-after-free and system crash or possibly have unspecified other impact via a crafted USB device. NOTE: the...

K58530825: Apache CXF vulnerability CVE-2017-5653

Security Advisory Description JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers. CVE-2017-5653 Impact There is no impact; F5 products are not affected by th...

K32888092: Linux Kernel vulnerability CVE-2019-13648

Security Advisory Description In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service TM Bad Thing exception and system crash via a sigreturn system call that sends a crafted signal frame. This affects...

K29538335: BIND vulnerability CVE-2019-6467

Security Advisory Description A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in...

K52319810: Apache Portable Runtime vulnerability CVE-2017-12613

Security Advisory Description When aprtimeexp or aprosexptime functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an aprtimeexpt value, potentially revealing the contents of a...

K8602: XSS vulnerability viewing logs from the web management interface

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

K44271140: Linux kernel vulnerability CVE-2017-18218

Security Advisory Description In drivers/net/ethernet/hisilicon/hns/hnsenet.c in the Linux kernel before 4.13, local users can cause a denial of service use-after-free and BUG or possibly have unspecified other impact by leveraging differences in skb handling between hnsnicnetxmithw and...

K10674: Netscape reuse cipher change bug - Qualsys QID 38284

Security Advisory Description Note : For information about signing up to receive security notice updates from F5, refer to K9970: Subscribe to email notifications regarding F5 products and security announcements. Note : Versions that are not listed in this article have not been evaluated for...

K02460950: Linux kernel vulnerability CVE-2017-18552

Security Advisory Description An issue was discovered in net/rds/afrds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rdsrecvtracklatency. CVE-2017-18552 Impact An attacker may potentially be able to cause modification or disclosure of information...

K17159: PAM vulnerability CVE-2009-2410

Security Advisory Description The localhandlercallback function in server/responder/pam/pamLOCALdomain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in...

K07369970: TMM vulnerability CVE-2017-6151

Security Advisory Description In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, undisclosed requests made to BIG-IP virtual servers which make use of the "HTTP/2 profile" may result in a disruption of...

K16718: libTIFF vulnerability CVE-2010-2596

Security Advisory Description The OJPEGPostDecode function in tifojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service assertion failure and application exit via a crafted TIFF image, related to "downsampled OJPEG input." CVE-2010-2596 Impact...

K15958: Ghostscript BaseFont vulnerability CVE-2008-6679

Security Advisory Description Buffer overflow in the BaseFont writer module in Ghostscript 8.62, and possibly other versions, allows remote attackers to cause a denial of service ps2pdf crash and possibly execute arbitrary code via a crafted Postscript file. CVE-2008-6679 Impact None. No F5...

K17172: OpenJDK vulnerability CVE-2015-2638

Security Advisory Description Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. CVE-2015-2638 Impact Confidentiality ...

K13421245: TMM vulnerability CVE-2017-6162

Security Advisory Description In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects T...

K73059510: Undertow vulnerabilities CVE-2019-10212 and CVE-2020-1745

Security Advisory Description CVE-2019-10212 A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files. CVE-2020-1745 A file inclusion vulnerability was found...

K71059632: PHP vulnerability CVE-2015-8616

Security Advisory Description Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collatorsort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact by leveraging the...

K46264120: BIND vulnerability CVE-2016-1285

Security Advisory Description named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service assertion failure and daemon exit via a malformed packet to the rndc aka control channel interface, related to alist.c and sexpr.c. CVE-2016-1285...

K12156: PHP xmlrpc vulnerability - CVE-2010-0397

Security Advisory Description Note : For information about signing up to receive security notice updates from F5, refer to K9970: Subscribe to email notifications regarding F5 products and security announcements. Note : Versions that are not listed in this article have not been evaluated for...

K06345931: F5OS vulnerability CVE-2023-22657

Security Advisory Description Processing F5OS tenant file names may allow for command injection. CVE-2023-22657 Impact An attacker may trick an administrator to upload a file with a specially crafted file name that injects commands. Security Advisory Status F5 Product Development has assigned ID...

K32196386: Linux kernel vulnerability CVE-2019-19447

Security Advisory Description In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4putsuper in fs/ext4/super.c, related to dumporphanlist in fs/ext4/super.c. CVE-2019-19447 Impact There is no impact; F...

SOL03534020 - PHP vulnerability CVE-2016-5767

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL71489519 - Wireshark vulnerability CVE-2015-4652

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL10133477 - BIG-IP IPsec IKE peer listener vulnerability CVE-2016-5736

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL05715414 - Apache CloudStack vulnerability CVE-2016-3085

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

SOL51758043 - MySQL vulnerability CVE-2016-0639

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

SOL15439022 - glibc vulnerability CVE-2016-3075

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL17257 - D-Bus vulnerability CVE-2014-3639

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can...

SOL17155 - TMM vulnerability CVE-2015-4638

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

SOL17174 - OpenJDK vulnerability CVE-2015-4733

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can...