F5-K000140954: Null Pointer Dereference
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."
Affected Software
Event History
Frequently Asked Questions
What is the severity of F5-K000140954?
The severity of F5-K000140954 is considered high due to the potential for a NULL pointer dereference.
How do I fix F5-K000140954?
To fix F5-K000140954, update to the latest version of the affected software that addresses the vulnerability.
What versions are affected by F5-K000140954?
F5-K000140954 affects F5 BIG-IP versions between 15.1.0 and 15.1.10, 16.1.0 and 16.1.5, and 17.1.0 and 17.1.1, as well as specific versions of F5 BIG-IQ and F5 Traffix SDC.
What are the potential impacts of F5-K000140954?
The potential impacts of F5-K000140954 include application crashes or unexpected behavior due to the NULL pointer dereference.
Who discovered F5-K000140954?
F5-K000140954 was discovered by a third-party researcher who highlighted the error handling issue in libarchive.