CVE-2015-5058
No known exploitation. EPSS puts it in the 79th percentile. A vendor fix is available.
What to do
The vendor has published a fix. Version details are below where the sources state them.
What it is
From the CVE record
Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ Cloud, Device, and Security 4.4.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted ICMP packets.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
1.9% chance of exploitation activity in the next 30 days, which ranks it in the 79th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
5 events over 3958 days, from the signal feeds we watch.
- OpenVAS check added
- Patch availablerecord updated
- Publishedweakness classified
Affected products
- BIG-IP Access Policy ManagerNetworking Infrastructure / firewall
- BIG-IP Advanced Firewall ManagerSecurity Products
- BIG-IP AnalyticsNetworking Infrastructure / network-management
- BIG-IP Application Acceleration ManagerNetworking Infrastructure / load-balancer-proxy
- BIG-IP Application Security ManagerNetworking Infrastructure / firewall
- BIG-IP Global Traffic ManagerNetworking Infrastructure / load-balancer-proxy
- BIG-IP Link ControllerNetworking Infrastructure / router-switch
- BIG-IP Local Traffic ManagerNetworking Infrastructure / load-balancer-proxy
- big-ip access policy managerNetworking Infrastructure / firewall
- big-ip advanced firewall managerNetworking Infrastructure / firewall
- big-ip analyticsNetworking Infrastructure / network-management
- big-ip application acceleration managerNetworking Infrastructure / load-balancer-proxy
- big-ip application security managerNetworking Infrastructure / firewall
- big-ip global traffic managerNetworking Infrastructure / load-balancer-proxy
- big-ip link controllerNetworking Infrastructure / router-switch
- big-ip local traffic managerNetworking Infrastructure / load-balancer-proxy
And 9 more affected products. See all after sign-in
Technical detail
CVSS 2.0 vector
Open in the CVSS calculatorAV:N/AC:L/Au:N/C:N/I:N/A:C
Scored 7.8 by NVD.
How it is reached
- Access Vector NetworkExploitable remotely over the network
- Access Complexity LowNo special conditions required
- Authentication NoneNo authentication required
Impact if exploited
- Confidentiality NoneNo confidentiality impact
- Integrity NoneNo integrity impact
- Availability CompleteTotal shutdown of the affected resource
Weaknesses
Sources
References in the record
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for F5 Networks, Inc., not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI