deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-5083
Published: 2017-10-27
Description: Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5084
Published: 2017-10-27
Description: Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: http://www.securityfocus.com/bid/98986; https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-chrome-os.html; https://crbug.com/702030
CVE: CVE-2017-5085
Published: 2017-10-27
Description: Inappropriate implementation in Bookmarks in Google Chrome prior to 59 for iOS allowed a remote attacker who convinced the user to perform certain operations to run JavaScript on chrome:// pages via a crafted bookmark.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5086
Published: 2017-10-27
Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98861; http://www.securitytracker.com/id/1038622; https://access.redhat.com/errata/RHSA-2017:1399
CVE: CVE-2017-5087
Published: 2017-10-27
Description: A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, aka an IndexedDB sandbox escape.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99096; http://www.securitytracker.com/id/1038765
CVE: CVE-2017-5088
Published: 2017-10-27
Description: Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99096; http://www.securitytracker.com/id/1038765
CVE: CVE-2017-5089
Published: 2017-10-27
Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.104 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99096; http://www.securitytracker.com/id/1038765
CVE: CVE-2017-5090
Published: 2017-10-27
Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name containing a U+0620 character, aka Apple rdar problem 32458012.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101591; https://crbug.com/725660; http://www.securityfocus.com/bid/101591
CVE: CVE-2017-5091
Published: 2017-10-27
Description: A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5092
Published: 2017-10-27
Description: Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5093
Published: 2017-10-27
Description: Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5094
Published: 2017-10-27
Description: Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-843
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5095
Published: 2017-10-27
Description: Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5096
Published: 2017-10-27
Description: Insufficient policy enforcement during navigation between different schemes in Google Chrome prior to 60.0.3112.78 for Android allowed a remote attacker to perform cross origin content download via a crafted HTML page, related to intents.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833; https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html
CVE: CVE-2017-5097
Published: 2017-10-27
Description: Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5098
Published: 2017-10-27
Description: A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5099
Published: 2017-10-27
Description: Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5100
Published: 2017-10-27
Description: A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5101
Published: 2017-10-27
Description: Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5102
Published: 2017-10-27
Description: Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-908
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5103
Published: 2017-10-27
Description: Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-908
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5104
Published: 2017-10-27
Description: Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5105
Published: 2017-10-27
Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5106
Published: 2017-10-27
Description: Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5107
Published: 2017-10-27
Description: A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5108
Published: 2017-10-27
Description: Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5109
Published: 2017-10-27
Description: Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5110
Published: 2017-10-27
Description: Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3926; http://www.securityfocus.com/bid/99950; https://access.redhat.com/errata/RHSA-2017:1833
CVE: CVE-2017-5111
Published: 2017-10-27
Description: A use after free in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5112
Published: 2017-10-27
Description: Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5113
Published: 2017-10-27
Description: Math overflow in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5114
Published: 2017-10-27
Description: Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac, and 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5115
Published: 2017-10-27
Description: Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5116
Published: 2017-10-27
Description: Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5117
Published: 2017-10-27
Description: Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Linux and Windows allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5118
Published: 2017-10-27
Description: Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5119
Published: 2017-10-27
Description: Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5120
Published: 2017-10-27
Description: Inappropriate use of www mismatch redirects in browser navigation in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentially downgrade HTTPS requests to HTTP via a crafted HTML page. In other words, Chrome could transmit cleartext even though the user had entered an https URL, because of a misdesigned workaround for cases where the domain name in a URL almost matches the domain name in an X.509 server certificate (but differs in the initial "www." substring).
CVSS Score: 6.5 (MEDIUM)
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100610; http://www.securitytracker.com/id/1039291
CVE: CVE-2017-5121
Published: 2017-10-27
Description: Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100947; http://www.securitytracker.com/id/1039497
CVE: CVE-2017-5122
Published: 2017-10-27
Description: Inappropriate use of table size handling in V8 in Google Chrome prior to 61.0.3163.100 for Windows allowed a remote attacker to trigger out-of-bounds access via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.debian.org/security/2017/dsa-3985; http://www.securityfocus.com/bid/100947; http://www.securitytracker.com/id/1039497
CVE: CVE-2017-14182
Published: 2017-10-27
Description: A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://code610.blogspot.com/2017/10/patch-your-fortinet-cve-2017-14182.html; http://www.securityfocus.com/bid/101559; http://www.securitytracker.com/id/1039678
CVE: CVE-2017-7733
Published: 2017-10-27
Description: A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101563; http://www.securitytracker.com/id/1039677; https://fortiguard.com/psirt/FG-IR-17-113
CVE: CVE-2017-0303
Published: 2017-10-27
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation. Connections may be left in the connection table which then can only be removed by restarting TMM. Over time this may lead to the BIG-IP being unable to process further connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: http://www.securityfocus.com/bid/101612; http://www.securitytracker.com/id/1039674; https://support.f5.com/csp/article/K30201296
CVE: CVE-2017-6157
Published: 2017-10-27
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5.4, virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an unauthenticated, remote attack that allows modification of BIG-IP system configuration, extraction of sensitive system files, and/or possible remote command execution on the BIG-IP system.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/101634; http://www.securitytracker.com/id/1039672; https://support.f5.com/csp/article/K02692210
CVE: CVE-2017-6159
Published: 2017-10-27
Description: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a denial of service attack when the MPTCP option is enabled on a virtual server. Data plane is vulnerable when using the MPTCP option of a TCP profile. There is no control plane exposure. An attacker may be able to disrupt services by causing TMM to restart hence temporarily failing to process traffic.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/101633; http://www.securitytracker.com/id/1039669; https://support.f5.com/csp/article/K10002335
CVE: CVE-2017-6160
Published: 2017-10-27
Description: In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request to cause Traffic Management Microkernel (TMM) to restart and temporarily fail to process traffic. This issue is exposed on virtual servers using a Policy Enforcement profile or a Web Acceleration profile. Systems that do not have BIG-IP AAM module provisioned are not vulnerable. The Traffic Management Microkernel (TMM) may restart and temporarily fail to process traffic. Systems that do not have BIG-IP AAM or PEM module provisioned are not vulnerable.
CVSS Score: 5.9 (MEDIUM)
References: http://www.securityfocus.com/bid/101632; http://www.securitytracker.com/id/1039670; https://support.f5.com/csp/article/K19430431
CVE: CVE-2017-6161
Published: 2017-10-27
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 11.2.1, when ConfigSync is configured, attackers on adjacent networks may be able to bypass the TLS protections usually used to encrypted and authenticate connections to mcpd. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) attack via resource exhaustion.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: http://www.securityfocus.com/bid/101636; http://www.securitytracker.com/id/1039675; http://www.securitytracker.com/id/1039676
CVE: CVE-2017-6162
Published: 2017-10-27
Description: In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, 11.2.1, in some cases TMM may crash when processing TCP traffic. This vulnerability affects TMM via a virtual server configured with TCP profile. Traffic processing is disrupted while Traffic Management Microkernel (TMM) restarts. If the affected BIG-IP system is configured to be part of a device group, it will trigger a failover to the peer device.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101635; http://www.securitytracker.com/id/1039673; https://support.f5.com/csp/article/K13421245
CVE: CVE-2017-6163
Published: 2017-10-27
Description: In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile, and the client initiates a number of concurrent streams beyond the advertised limit can cause a disruption of service. Remote client initiating stream beyond the advertised limit can cause a disruption of service. The Traffic Management Microkernel (TMM) data plane is exposed to this issue; the control plane is not exposed.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101606; http://www.securitytracker.com/id/1039671; https://support.f5.com/csp/article/K22541983