BIG IP Access Policy Manager

DATE	CVE	VULNERABILITY TITLE	RISK
2014-09-24	CVE-2014-6271	OS Command Injection vulnerability in multiple products GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. network low complexity gnu arista oracle qnap mageia redhat suse opensuse debian ibm canonical novell checkpoint f5 citrix apple vmware CWE-78 critical	9.8
2012-05-24	CVE-2011-3188	The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets. network low complexity linux redhat f5 critical	9.1