CVE-2016-7476

CWE-20 — Improper Input Validation4 documents4 sources

Severity

7.5HIGH

EPSS

1.2%

top 21.12%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

F5 Big-ip Access Policy Manager F5 Big-ip Advanced Firewall Manager F5 Big-ip Application Acceleration Manager +7 more

Timeline

PublishedMay 11

Latest updateMay 14

Description

The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 before 11.5.3 HF2, and 11.3.0 before 11.4.1 HF10 may suffer from a memory leak while handling certain types of TCP traffic. Remote attackers may cause a denial of service (DoS) by way of a crafted TCP packet.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages10 packages

▶NVDf5/big-ip_link_controller8 versions+7

▶NVDf5/big-ip_local_traffic_manager8 versions+7

▶NVDf5/big-ip_global_traffic_manager8 versions+7

▶NVDf5/big-ip_websafe11.6.0

▶NVDf5/big-ip_access_policy_manager8 versions+7

🔴Vulnerability Details

GHSA

GHSA-j6wf-w5r4-84pv: The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11↗2022-05-14

▶

CVEList

CVE-2016-7476: The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11↗2017-05-11

▶

📋Vendor Advisories

CVE-2016-7476: The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and We...↗2017-05-11

▶