BIG-IP Release Information

Version: 11.6.2
Build: 495.0

Cumulative fixes from BIG-IP v11.6.1 Hotfix 2 that are included in this release
Cumulative fixes from BIG-IP v11.6.1 Hotfix 1 that are included in this release
Cumulative fixes from BIG-IP v11.6.1 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 8 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 7 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 6 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 5 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 4 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 3 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 2 that are included in this release
Cumulative fixes from BIG-IP v11.6.0 Hotfix 1 that are included in this release
Known Issues in BIG-IP v11.6.x

Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
653880-1	CVE-2017-6214	K81211720	Kernel Vulnerability: CVE-2017-6214
652516-1	CVE-2016-10088 CVE-2016-10142 CVE-2016-2069 CVE-2016-2384 CVE-2016-6480 CVE-2016-7042 CVE-2016-7097 CVE-2016-8399 CVE-2016-9576	K31603170	Multiple Linux Kernel Vulnerabilities
649907-3	CVE-2017-3137	K30164784	BIND vulnerability CVE-2017-3137
649904-3	CVE-2017-3136	K23598445	BIND vulnerability CVE-2017-3136
648865-1	CVE-2017-6074	K82508682	Linux kernel vulnerability: CVE-2017-6074
644904-4	CVE-2016-7922, CVE-2016-7923, CVE-2016-7924, CVE-2016-7925, CVE-2016-7926, CVE-2016-7927, CVE-2016-7928, CVE-2016-7929, CVE-2016-7930, CVE-2016-7931, CVE-2016-7932, CVE-2016-7933, CVE-2016-7934, CVE-2016-7935, CVE-2016-7936, CVE-2016-7937, CVE-2016-7938, CVE-2016-7939, CVE-2016-7940, CVE-2016-7973, CVE-2016-7986, CVE-2016-7992, CVE-2016-7993, CVE-2016-8574, CVE-2016-8575, CVE-2016-7974, CVE-2016-7975, CVE-2016-7983, CVE-2016-7984, CVE-2016-7985 CVE-2017-5202, CVE-2017-5203, CVE-2017-5204, CVE-2017-5205, CVE-2017-5341, CVE-2017-5342, CVE-2017-5482, CVE-2017-5483, CVE-2017-5484, CVE-2017-5485, CVE-2017-5486	K55129614	tcpdump 4.9
644693-4	CVE-2016-2183, CVE-2017-3272, CVE-2017-3289, CVE-2017-3253, CVE-2017-3261, CVE-2017-3231,CVE-2016-5547,CVE-2016-5552, CVE-2017-3252, CVE-2016-5546, CVE-2016-5548, CVE-2017-3241	K15518610	Fix for multiple CVE for openjdk-1.7.0
643187-3	CVE-2017-3135	K80533167	BIND vulnerability CVE-2017-3135
641360-3	CVE-2017-0303	K30201296	SOCKS proxy protocol error
638556-3	CVE-2016-10045	K73926196	PHP Vulnerability: CVE-2016-10045
636702-2	CVE-2016-9444	K40181790	BIND vulnerability CVE-2016-9444
636700-3	CVE-2016-9147	K02138183	BIND vulnerability CVE-2016-9147
636699-4	CVE-2016-9131	K86272821	BIND vulnerability CVE-2016-9131
630475-4	CVE-2017-6162	K13421245	TMM Crash
626360-5	CVE-2017-6163	K22541983	TMM may crash when processing HTTP2 traffic
624526-1	CVE-2017-6159	K10002335	TMM core in mptcp
610255-2	CVE-2017-6161	K62279530	CMI improvement
563154-2	CVE-2015-2925 CVE-2015-5307 CVE-2015-7613 CVE-2015-7872 CVE-2015-8104	K31026324 K94105604 K90230486	Multiple Linux Kernel vulnerabilities
560109-3	CVE-2017-6160	K19430431	Client capabilities failure
540174-3	CVE-2015-5364 CVE-2015-5366	K17307 K17309	CVE updates from https://rhn.redhat.com/errata/RHSA-2015-1623.html
648879-1	CVE-2016-6136 CVE-2016-9555	K90803619	Linux kernel vulnerabilities: CVE-2016-6136 CVE-2016-9555
645101-4	CVE-2017-3731, CVE-2017-3732	K44512851	OpenSSL vulnerability CVE-2017-3732
640768-1	CVE-2016-10088	K05513373	Kernel vulnerability: CVE-2016-10088
638137-1	CVE-2016-7117 CVE-2016-4998 CVE-2016-6828	K51201255	CVE-2016-7117 CVE-2016-4998 CVE-2016-6828
637666-3	CVE-2016-10033	K74977440	PHP Vulnerability: CVE-2016-10033
635314-4	CVE-2016-1248	K22183127	vim Vulnerability: CVE-2016-1248
631688-4	CVE-2016-9311 CVE-2016-9310 CVE-2016-7427 CVE-2016-7428 CVE-2016-9312 CVE-2016-7431 CVE-2016-7434 CVE-2016-7429 CVE-2016-7426 CVE-2016-7433	K55405388 K87922456 K63326092 K51444934 K80996302	Multiple NTP vulnerabilities
625372-2	CVE-2016-2179	K23512141	OpenSSL vulnerability CVE-2016-2179
623119-6	CVE-2016-4470	K55672042	Linux kernel vulnerability CVE-2016-4470
622496-6	CVE-2016-5829	K28056114	Linux kernel vulnerability CVE-2016-5829
622126-3	CVE-2016-7124 CVE-2016-7125 CVE-2016-7126 CVE-2016-7127	K54308010	PHP vulnerability CVE-2016-7124
614147-3	CVE-2017-6157	K02692210	SOCKS proxy defect resolution
613225-3	CVE-2016-2180, CVE-2016-6306, CVE-2016-6302	K90492697	OpenSSL vulnerability CVE-2016-6306
613127-6	CVE-2016-5696	K46514822	Linux TCP Stack vulnerability CVE-2016-5696
607314-3	CVE-2016-3500, CVE-2016-3508	K25075696	Oracle Java vulnerability CVE-2016-3500, CVE-2016-3508
600232-4	CVE-2016-2177	K23873366	OpenSSL vulnerability CVE-2016-2177
600223-4	CVE-2016-2177	K23873366	OpenSSL vulnerability CVE-2016-2177
592485-2	CVE-2015-5157 CVE-2015-8767	K17326	Linux kernel vulnerability CVE-2015-5157
592001-2	CVE-2016-4071 CVE-2016-4073	K64412100	CVE-2016-4073 PHP vulnerabilities
540018-2	CVE-2014-3940 CVE-2014-3184 CVE-2015-0239	K16429 K15685 K15912	Multiple Linux Kernel Vulnerabilities
533413-4	CVE-2011-5321 CVE-2015-3636 CVE-2015-1593 CVE-2015-2830 CVE-2015-2922	K51518670	CVE updates from https://rhn.redhat.com/errata/RHSA-2015-1221.html
527563-6	CVE-2015-1805 CVE-2015-3331 CVE-2014-9419 CVE-2014-9420 CVE-2014-9585	K17458 K16819 K17551 K17543 K17241	Kernel Vulnerabilities
600205-4	CVE-2016-2178	K53084033	OpenSSL Vulnerability: CVE-2016-2178
598002-3	CVE-2016-2178	K53084033	OpenSSL vulnerability CVE-2016-2178
591438-2	CVE-2015-8865	K54924436	PHP vulnerability CVE-2015-8865
569355-3	CVE-2015-4871 CVE-2015-7575 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494	K50118123	Java vulnerabilities CVE-2015-4871 CVE-2015-7575 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494
492732-2	CVE-2014-3184	K15912	Linux kernel driver vulnerabilities CVE-2014-3184, CVE-2014-3185, CVE-2014-3611, CVE-2014-3645, and CVE-2014-3646
655021-3	CVE-2017-3138	K23598445	BIND vulnerability CVE-2017-3138
621935-3	CVE-2016-6304	K54211024	OpenSSL vulnerability CVE-2016-6304

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
643210-1	2-Critical	K45444280	Restarting MCPD on Secondary Slot of Chassis causes deletion of netHSM keys on SafeNet HSM
633723-2	3-Major		New diagnostics run when a crypto HA failure occurs and crypto.ha.action is reboot
609674-2	3-Major	K38333488	machine certificate check creates issuer string with DC with reverse order
545263-4	3-Major		Add SSL maximum aggregate active handshakes per profile and per global

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
534824-1	1-Blocking	K02954921	Incorrect key/certificate when creating clientSSL profile and modifying key/cert in the same transaction.
480073-1	1-Blocking		Adding a new chassis and syncing the configuration cause mcpd to restart.
655059-2	2-Critical		TMM Crash
638935-7	2-Critical		Monitor with send/receive string containing double-quote may cause upgrade to fail.★
625824-3	2-Critical		iControl calls related to key and certificate management (Management::KeyCertificate) might leak memory
610354-2	2-Critical		TMM crash on invalid memory access to loopback interface stats object
542898-3	2-Critical		Virtual Edition: Disk partition /var shows 100% after live install to 12.0.0
528343-2	2-Critical		Loading cli preference that does not contain the user attribute will fail
514514-1	2-Critical	K96156151	Running gtm_add can result in error message about encrypted attributes.
513151-8	2-Critical	K17312	VIPRION B2150 blades show up as unknown when SNMP queries the OID sysObjectID.
483373-2	2-Critical		Incorrect bash prompt for created admin role users
667278-4	3-Major		DSC connections between BIG-IP units may fail to establish
650002-3	3-Major		tzdata bug fix and enhancement update
648316	3-Major		Flows using DEFLATE decompresion can generate error message during flow tear-down.
647944-3	3-Major		MCP may crash when making specific changes to a FIX profile attached to more than one virtual server
645179-3	3-Major	K42751321	Traffic group becomes active on more than one BIG-IP after a long uptime
644184-1	3-Major	K36427438	ZebOS daemons hang while AgentX SNMP daemon is waiting.
631627-5	3-Major		Applying BWC over route domain sometimes results in tmm not becoming ready on system start
628164-2	3-Major		OSPF with multiple processes may incorrectly redistribute routes
622133-4	3-Major		VCMP guests may incorrectly obtain incorrect MAC addresses
621273-4	3-Major		DSR tunnels with transparent monitors may cause TMM crash.
619060-2	3-Major		Reduction in boot time in BIG-IP Virtual Edition platforms
617628-2	3-Major		SNMP reports incorrect value for sysBladeTempTemperature OID
491406-1	3-Major		TMM SIGSEGV in sctp_output due to NULL snd_dst
485164-2	3-Major		MCPD cores when the Check Service Date in the license is not current.
393270-4	3-Major		Configuration utility may become non-responsive or fail to load.
655691-1	4-Minor		GUI image list contains misleading 'MD5 Sum Verified' field
654566-1	4-Minor	K94822416	Incomplete files still linked in /shared/vmisolinks
634371-3	4-Minor		Cisco ethernet NIC driver
442322-2	4-Minor		vCMP guest names in statistics limited to 32 characters

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
618905-3	1-Blocking		tmm core while installing Safenet 6.2 client
684879-3	2-Critical		Malformed TLS1.2 records may result in TMM segmentation fault.
653993-2	2-Critical		A specific sequence of packets to the HA listener may cause tmm to produce a core file
646604-3	2-Critical	K21005334	Client connection may hang when NTLM and OneConnect profiles used together
642400-1	2-Critical		Path MTU discovery occasionally fails
637181-3	2-Critical		VIP-on-VIP traffic may stall after routing updates
635274-3	2-Critical	K21514205	SSL::sessionid command may return invalid values
634259	2-Critical		IP tuple nexthop object can be freed while still referenced by another structure
625198-3	2-Critical		TMM might crash when TCP DSACK is enabled
603667-3	2-Critical		TMM may leak or corrupt memory when configuration changes occur with plugins in use
600982-1	2-Critical		TMM crashes at ssl_cache_sid() with "prf->cache.sid == 0"
597978-4	2-Critical		GARPs may be transmitted by active going offline
581829-1	2-Critical		Traffic that uses a network HSM for crypto services can fail to recover.
566071-1	2-Critical		network-HSM may not be operational on secondary slots of a standby chassis.
503125-4	2-Critical		Excessive MPI net traffic can cause tmm panics on chassis systems
477195-3	2-Critical		OSPFv3 session gets stuck in loading state
474797	2-Critical		Malformed SSL packets can cause errors in /var/log/ltm
663326-3	3-Major		Thales HSM: "fipskey.nethsm --export" fails to make stub keys
654109-3	3-Major	K01102467	Configuration loading may fail when iRules calling procs in other iRules are deleted
648954-3	3-Major	K01102467	Configuration validation (e.g., ConfigSync) may fail after an iRule is deleted, if the iRule made procedure calls
643582-1	3-Major		Config load with large ssl profile configuration may cause tmm restart
624903-3	3-Major		Improved handling of crypto hardware decrypt failures on 2000s/2200s or 4000s/4200v platforms.
622178-3	3-Major		Improve flow handling when Autolasthop is disabled
613369-1	3-Major		Half-Open TCP Connections Not Discoverable
612694-3	3-Major		TCP::close with no pool member results in zombie flows
608551-4	3-Major		Half-closed congested SSL connections with unclean shutdown might stall.
604496-2	3-Major		SQL (Oracle) monitor daemon might hang.
508486-2	3-Major		TCP connections might stall if initialization fails
499615-3	3-Major	K49031780	RAM cache serves zero length documents.
423392-5	3-Major		tcl_platform is no longer in the static:: namespace
511985-4	4-Minor	K46811087	Large numbers of ERR_UNKNOWN appearing in the logs

Global Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
468503-1	3-Major	K17109	The Update Check operation reports a different version of IP geolocation database than what is installed.

Application Security Manager Fixes

ID Number	Severity	Solution Article(s)	Description
618771-2	2-Critical		Some Social Security Numbers are not being masked
577668-1	2-Critical		ASM Remote logger doesn't log 64 KB request.
569583-1	2-Critical		Secondary Blade Rejects All Traffic after being added to the chassis★
568347-2	2-Critical		BD Memory corruption
665905-1	3-Major	K83305000	Signature System corruption from specific ASU prevents ASU load after upgrade
664930-1	3-Major		Policy automatic learning mode changes to manual after failover
625832-2	3-Major	K89255958	A false positive modified domain cookie violation
616169-2	3-Major		ASM Policy Export returns HTML error file
604923-3	3-Major		REST id for Signatures change after update
572885-2	3-Major		Policy automatic learning mode changes to manual after failover
427644-2	3-Major	K37066694	asm_config_server_rpc might crash during ASM policy sync
366605-1	3-Major		response_log_size_limit does not limit the log size.
557098-1	4-Minor		correlation is continuously restarted with "An instance with pid xxxx is already running" error in the ltm log

Application Visibility and Reporting Fixes

ID Number	Severity	Solution Article(s)	Description
602654-3	2-Critical		TMM crash when using AVR lookups
639617	3-Major		When AVR collect Page load time and/or session data the Content-Length can be set incorrectly
635561-3	3-Major		Heavy URLs statistics are not shown after upgrade.
631722-2	3-Major		Some HTTP statistics not displayed after upgrade
573764-3	3-Major		In some cases, only primary blade retains it's statistics after upgrade on multi bladed system
570926-1	3-Major		Provide a way to configure where in payload the CSPM JS is injected.
560114-7	3-Major		Monpd is being affected by an I/O issue which makes some of its threads freeze
512303-1	3-Major	K02471248	Install does not complete (stays at 0%) because the UCS save operation hangs while backing up the AVR database.
639395-1	4-Minor	K91614278	AVR does not display 'Max read latency' units.

Access Policy Manager Fixes

ID Number	Severity	Solution Article(s)	Description
679235-4	2-Critical		Inspection Host NPAPI Plugin for Safari can not be installed
638570-2	2-Critical		"ACCESS::session remove" hangs in ACCESS_POLICY_COMPLETED
632798-1	2-Critical	K30710317	Double-free may occur if Access initialization fails
499800-1	2-Critical	K34140143	Customized logout page is not displayed after logon failure
481481-1	2-Critical		APM on a multi blade chassis: On an idle machine 'rewrite' processes can takes up to half CPU cycles.
676300-6	3-Major	K04551025	EPSEC binaries may fail to upgrade in some cases★
658852-1	3-Major		Empty User-Agent in iSessions requests from APM client on Windows
649613-1	3-Major		Multiple UDP/TCP packets packed into one DTLS Record
645684-1	3-Major		Flash application components are loaded into wrong ApplicationDomain after Portal Access rewriting.
638780-1	3-Major		Handle 302 redirects for VMware Horizon View HTML5 client
620829-4	3-Major		Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly
619486-1	3-Major		Scripts on rewritten pages could fail with JavaScript exception if application code modifies window.self
618170-1	3-Major		Some URL unwrapping functions can behave bad
615970-2	3-Major	K02319425	SSO logging level may cause failover
601420-2	3-Major		Possible SAML authentication loop with IE and multi-domain SSO.
600069-3	3-Major		Portal Access: Requests handled incorrectly
597214-2	3-Major		Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly
583272-1	3-Major	K11736022	"Corrupted Connect Error" when using IPv6 and On-Demand Cert Auth
559402-1	3-Major		Client initiated form based SSO fails when username and password not replaced correctly while posting the form
557841-1	3-Major		Policy sync fails when adding host to AppTunnel on LSO resolve
557399-2	3-Major		Browser could become unresponsive when page with specific script constructions is accessed through Portal Access
508699-1	3-Major	K03737485	Import with reuse is failing if profile and resource are sharing the same name
474606-1	3-Major		[Flash AS3] ApplicationDomain matching fails for relative URLs
611968-1	4-Minor		JavaScript Active content at an HTML page browsed by IE8 with significant amount of links (>1000) can run very slow

WebAccelerator Fixes

ID Number	Severity	Solution Article(s)	Description
476460-6	4-Minor	K16143	WAM Range HTTP header limited to 8 ranges

Wan Optimization Manager Fixes

ID Number	Severity	Solution Article(s)	Description
644970-2	2-Critical		Editing a virtual server config loses SSL encryption on iSession connections
644489-2	3-Major	K14899014	Unencrypted iSession connection established even though data-encrypt configured in profile

Service Provider Fixes

ID Number	Severity	Solution Article(s)	Description
649933-3	3-Major		Fragmented RADIUS messages may be dropped

Carrier-Grade NAT Fixes

ID Number	Severity	Solution Article(s)	Description
652400-1	3-Major		During blade changes, PBA may cause a TMM restart

Global Traffic Manager (DNS) Fixes

ID Number	Severity	Solution Article(s)	Description
624193-1	3-Major		Topology load balancing not working as expected
644220-2	4-Minor	K37049259	Flawed logic when retrieving an LTM Virtual Server's assigned Link on the LTM Virtual Server Properties page

Cumulative fixes from BIG-IP v11.6.1 Hotfix 2 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
631582-4	CVE-2016-9250	K55792317	Administrative interface enhancement
624570-3	CVE-2016-8864	K35322517	BIND vulnerability CVE-2016-8864
624457-3	CVE-2016-5195	K10558632	Linux privilege-escalation vulnerability (Dirty COW) CVE-2016-5195
616864-3	CVE-2016-2776	K18829561	BIND vulnerability CVE-2016-2776
612128	CVE-2016-6515	K31510510	OpenSSH vulnerability CVE-2016-6515
611469-2	CVE-2016-7467	K95444512	Traffic disrupted when malformed, signed SAML authentication request from an authenticated user is sent via SP connector
597394-1	CVE-2016-9252	K46535047	Improper handling of IP options
596340-3	CVE-2016-9244	K05121675	F5 TLS vulnerability CVE-2016-9244
591329-2	CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109	K36488941	CVE-2016-2108 fixed in Oracle Access Manager library used by BIG-IP APM
588496-3	CVE-2009-3555	K10737	SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541
586131-3	CVE-2014-3566	K15702	SSLv3 vulnerability CVE-2014-3566
580026-3	CVE-2017-6165	K74759095	HSM logging error
635412-2	CVE-2017-6137	K82851041	Invalid mss with fast flow forwarding and software syn cookies
618261-3	CVE-2016-2182	K01276005	OpenSSL vulnerability CVE-2016-2182
604442-1	CVE-2016-6249	K12685114	iControl log
597023-4	CVE-2016-4954	K82644737	NTP vulnerability CVE-2016-4954
594496-3	CVE-2016-4539	K35240323	PHP Vulnerability CVE-2016-4539
591455-2	CVE-2016-1550 CVE-2016-1548 CVE-2016-2516 CVE-2016-2518	K24613253	NTP vulnerability CVE-2016-2516
591447-3	CVE-2016-4070	K42065024	PHP vulnerability CVE-2016-4070
520924-4	CVE-2016-5020	K00265182	Restricted roles for custom monitor creation
475743-4	CVE-2017-6128	K92140924	Improve administrative login efficiency
635933-1	CVE-2004-0790	K23440942 K13361021	The validation of ICMP messages for ePVA accelerated TCP connections needs to be configurable
600198-4	CVE-2016-2178 CVE-2016-6306 CVE-2016-6302	K53084033	OpenSSL vulnerability CVE-2016-2178
599285-4	CVE-2016-5094 CVE-2016-5095 CVE-2016-5096	K51390683	PHP vulnerabilities CVE-2016-5094 and CVE-2016-5095
597010-4	CVE-2016-4955	K03331206	NTP vulnerability CVE-2016-4955
596997-4	CVE-2016-4956	K64505405	NTP vulnerability CVE-2016-4956
591767-3	CVE-2016-1547	K11251130	NTP vulnerability CVE-2016-1547
573343-3	CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8158	K01324833	NTP vulnerability CVE-2015-8158

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
620712-1	3-Major		Added better search capabilities on the Pool Members Manage & Pool Create page.
599536-2	3-Major		IPsec peer with wildcard selector brings up wrong phase2 SAs
581840	3-Major		Cannot manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.
564876-1	3-Major		New DB variable log.lsn.comma changes CGNAT logs to CSV format
561348-4	3-Major		krb5.conf file is not synchronized between blades and not backed up
541549-4	3-Major		AWS AMIs for BIG-IP VE will now have volumes set to be deleted upon instance termination.
530109-5	3-Major		OCSP Agent does not honor the AIA setting in the client cert even though 'Ignore AIA' option is disabled.
454492-1	3-Major		Improved handling of signature_algorithms extension to avoid using SHA1 in TLS handshake signatures
451433-7	3-Major		HA group combined with other failover (e.g., VLAN Failsafe or Gateway Failsafe)
609084-1	4-Minor		Max number of chunks not configurable above 1000 chunks
591733-2	4-Minor	K83175883	Save on Auto-Sync is missing from the configuration utility.

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
624263-3	2-Critical		iControl REST API sets non-default profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets profile's non-default property value as "none"; properties missing in iControl REST API response
624245	2-Critical		Hung tasks leading to system problems and lack of management access via ssh/GUI
614865-2	2-Critical		Overwrite flag in iControl functions key/certificate_import_from_pem functions is ignored and might result in errors.
613536-2	2-Critical		tmm core while running the iRule STATS:: command
605476-2	2-Critical		istatsd can core when reading corrupt stats files.
601527-3	2-Critical		mcpd memory leak and core
591104-3	2-Critical		ospfd cores due to an incorrect debug statement.
587698-2	2-Critical		bgpd crashes when ip extcommunity-list standard with route target(rt) and Site-of-origin (soo) parameters are configured
583516-3	2-Critical		tmm ASSERT's "valid node" on Active, after timer fire..
574055-3	2-Critical		TMM crash after changing raccoon log level
570881-4	2-Critical		IPsec configuration mismatch in IKEv2 causes TMM crash in isakmp_parse_proposal ()
570663-3	2-Critical		Using iControl get_certificate_bundle_v2 causes a memory leak
570419-2	2-Critical		Use of session DB on multi-process appliances and blades may core.
567457-3	2-Critical		TMM may crash when changing the IKE peer config.
460833-1	2-Critical		MCPD sync errors and restart after multiple modifications to file object in chassis
457252-1	2-Critical		tmm crash when using sip_info persistence without a sip profile
440752-1	2-Critical		qkview might loop writing output file if MCPD fails during execution
355806-3	2-Critical		Starting mcpd manually at the command line interferes with running mcpd
623401-4	3-Major		Intermittent OCSP request failures due to non-optimal default TCP profile setting
621417-1	3-Major		sys-icheck error for /usr/share/defaults/bigip_base.conf in AWS.
621242	3-Major		Reserve enough space in the image for future upgrades.
616242-2	3-Major	K39944245	basic_string::compare error in encrypted SSL key file if the first line of the file is blank★
615934-2	3-Major		Overwrite flag in various iControl key/certificate management functions is ignored and might result in errors.
609119-5	3-Major		Occasionally the logging system prints out a blank message: err mcpd[19114]: 01070711:3:
608320-4	3-Major		iControl REST API sets non-default persistence profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets persistence profile's non-default property value as "none"; properties missing in iControl REST API response
604931-1	3-Major	K42028295	bgpd might core on restarting process with BGP debug enabled.
603149-1	3-Major		Large ike-phase2-lifetime-kilobytes values in racoon ipsec-policy
601502-1	3-Major		Excessive OCSP traffic
600558-3	3-Major		Errors logged after deleting user in GUI
597729-1	3-Major		Errors logged after deleting user in GUI
597601-4	3-Major		Improvement for a previous issue regressed NAT-T
596814-3	3-Major		HA Failover fails in certain valid AWS configurations
592870-3	3-Major		Fast successive MTU changes to IPsec tunnel interface crashes TMM
590904-5	3-Major		New HA Pair created using serial cable failover only will remain Active/Active
586878-2	3-Major		During upgrade, configuration fails to load due to clientssl profile with empty cert/key configuration.★
585485-4	3-Major		inter-ability with "delete IPSEC-SA" between AZURE, ASA, and the BIG-IP system
583285-7	3-Major		BIG-IP logs INVALID-SPI messages but does not remove the associated SAs.
577440-1	3-Major		audit logs may show connection to hagel.mnet
571344-3	3-Major		SSL Certificate with special characters might cause exception when GUI retrieves items list page.★
566507-2	3-Major		Wrong advertised next-hop in BGP for a traffic group in Active-Active deployment
560510-6	3-Major		Invalid /etc/resolv.conf when more than one DNS servers are set and MCPD is down.
557059-2	3-Major		When a virtual server has an Anti-Fraud Profile and a Web Acceleration profile, POST requests to non-protected URLs hang
543208	3-Major	K40670213	Upgrading v11.6.0 to v12.x in a sync-failover group might cause mcpd to become unresponsive.★
534021-5	3-Major		HA on AWS uses default AWS endpoint (EC2_URL).
533813-3	3-Major		Internal Virtual Server in partition fails to load from saved config
528498-5	3-Major		Recently-manufactured hardware may not be identified with the correct model name and SNMP OID
523642-5	3-Major		Power Supply status reported incorrectly after LBH reset
523527-6	3-Major	K43121346	Upgrade from 10.x to 11.2.0 or later does not add existing routing protocols to RD0.★
516540-3	3-Major		devmgmtd file object leak
509400-1	3-Major	K36089384	vCMP VIPRION: internal flooded unicast packets with multi-slot trunks impact performance
502714-4	3-Major	K75031635	Deleting files and file object references in a single transaction might cause validation errors
481089-7	3-Major		Request group incorrectly deleted prior to being processed
479660-2	3-Major		tmm crash in ipsec when ipsec-policy and ike-peer do not match.
460176-4	3-Major		Hardwired failover asserts active even when standalone
400456-3	3-Major		HTTP monitors with long send or receive strings may not save or update
339825-3	3-Major		Management.KeyCertificate.install_certificate_from_file failing silently
598498-4	4-Minor		Cannot remove Self IP when an unrelated static ARP entry exists.
585097-3	4-Minor		Traffic Group score formula does not result in unique values.
581835-3	4-Minor		Command failing: tmsh show ltm virtual vs_name detail.
551208-1	4-Minor		Nokia alarms are not deleted due to the outdated alert_nokia.conf.
542347-1	4-Minor		Denied message in audit log on first time boot
541320-6	4-Minor	K50973424	Sync of tunnels might cause restore of deleted tunnels.
535544-5	4-Minor		Enhancement: ltm virtual translate-port, translate-address are not listed if they are enabled
477700-1	4-Minor	K04116117	Detail missing from power supply 'Bad' status log messages
470627-2	5-Cosmetic		Incorrect and benign log message of bandwidth utilization exceeded when licensed with rate limit in VE
442231-2	5-Cosmetic		Pendsect log entries have an unexpected severity

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
622166	2-Critical		HTTP GET requests with HTTP::cookie iRule command receive no response
619528-2	2-Critical		TMM may accumulate internal events resulting in TMM restart
616215-2	2-Critical		TMM can core when using LB::detach and TCP::notify commands in an iRule
613088-1	2-Critical		pkcs11d thread has session initialization problem.
612229-2	2-Critical		TMM may crash if LTM a disable policy action for 'LTM Policy' is not last
607360-2	2-Critical		Safenet 6.2 library missing after upgrade★
605865-2	2-Critical		Debug TMM produces core on certain ICMP PMTUD packets
604223-1	2-Critical		pkcs11d signal handler improvement to turn off all threads at time of "SIGTERM"
603082-2	2-Critical		Ephemeral pool members are getting deleted/created over and over again.
603032-2	2-Critical		clientssl profiles with sni-default enabled may leak X509 objects
597966	2-Critical		ARP/neighbor cache nexthop object can be freed while still referenced by another structure
588351-2	2-Critical		IPv6 fragments are dropped when packet filtering is enabled.
574153-2	2-Critical		If an SSL client disconnects while data is being sent to SSL client, the connection may stall until TCP timeout.
526367-3	2-Critical		tmm crash
509646-7	2-Critical		Occasional connections reset when using persistence
480009-2	2-Critical		OSPFv2 Redistributed routes are deleted after blade failover with Graceful Restart
624616-3	3-Major		Safenet uninstall is unable to remove libgem.so
618517-2	3-Major		bigd may falsely complain of a file descriptor leak when it cannot open its debug log file
617862-1	3-Major		Fastl4 handshake timeout is absolute instead of relative
617858-1	3-Major		bigd core when using Tcl monitors
617824-2	3-Major		"SSL::disable/enable serverside" + oneconnect reuse is broken
613673-1	3-Major	K48693281	Pool members may not be marked up and/or there might be a slight delay in monitors
610609-1	3-Major		Total connections in bigtop, SNMP are incorrect
610429-3	3-Major		X509::cert_fields iRule command may memory with subpubkey argument
607304-2	3-Major		TMM is killed by SOD (missing heartbeat) during geoip_reload performing munmap.
606575-3	3-Major		Request-oriented OneConnect load balancing ends when the server returns an error status code.
604977-3	3-Major	K08905542	Wrong alert when DTLS cookie size is 32
603606	3-Major		tmm core
603236-2	3-Major		1024 and 4096 size key creation issue with SafeNet 6.2 with 6.10.9 firmware
602366-2	3-Major		Safenet 6.2 HA performance
602358-2	3-Major		BIG-IP ServerSSL connection may reset during rengotiation with some SSL/TLS servers due to ClientHello version
601496-1	3-Major		iRules and OCSP Stapling
601178-3	3-Major		HTTP cookie persistence 'preferred' encryption
600827-5	3-Major		Stuck nitrox crypto queue can erroneously be reported
600593-4	3-Major		Use of HTTP Explicit Proxy and OneConnect can lead to an issue with CONNECT HTTP requests
598874-3	3-Major		GTM Resolver sends FIN after SYN retransmission timeout
595275-2	3-Major		Virtual IP address change might cause VIP state to go from GREEN to RED to GREEN
594642-1	3-Major		Stream filter may require large allocations by Tcl leading TMM to core on allocation failure.
592871-2	3-Major		Cavium Nitrox PX/III stuck queue diagnostics missing.
592497-2	3-Major		Idle timeout ineffective for FIN_WAIT_2 when server-side expired and HTTP in fallback state.
591789-1	3-Major		IPv4 fragments are dropped when packet filtering is enabled.
591659-3	3-Major	K47203554	Server shutdown is propagated to client after X-Cnection: close transformation.
591476-8	3-Major	K53220379	Stuck crypto queue can erroneously be reported
591343-2	3-Major		SSL::sessionid output is not consistent with the sessionid field of ServerHello message.
588115-3	3-Major		TMM may crash with traffic to floating self-ip in range overlapping route via unreachable gw
586738-2	3-Major		The tmm might crash with a segfault.
584029-2	3-Major		Fragmented packets may cause tmm to core under heavy load
578971-1	3-Major		When mcpd is restarted on a blade, cluster members may be temporarily marked as failed
576224-1	3-Major		NetHSM does not come back after TCP connection to device is reset
573402-2	3-Major		"C_GetAttributeValue error" with netHSM
572281-2	3-Major		Variable value in the nesting script of foreach command get reset when there is parking command in the script
571573-2	3-Major	K20320811	Persistence may override node/pmbr connection limit
570057-3	3-Major		Can't install more than 16 SafeNet HSMs in its HA group
569642-4	3-Major		Deleting all routes on a unit with a mirroring fastL4 Virtual may cause TMM to core
569288-2	3-Major		Different LACP key may be used in different blades in a chassis system causing trunking failures
569206-2	3-Major	K47952434	After connectivity loss and restoration between HSM and pkcs11d, SSL fails on some blades.
568743-3	3-Major		TMM core when dnssec queries to dns-express zone exceed nethsm capacity
568543-3	3-Major		Syncookie mode is activated on wildcard virtuals
567862-1	3-Major		intermittent SSL traffic failure with Safenet HSM on BIG-IP chassis and appliance
565799-2	3-Major		CPU Usage increases when using masquerade addresses
563227-3	3-Major	K31104342	When a pool member goes down, persistence entries may vary among tmms
557358-1	3-Major		TMM SIGSEGV and crash when memory allocation fails.
556117-2	3-Major		client-ssl profile is case-sensitive when checking server_name extension
555432-1	3-Major		Large configuration files may go missing on secondary blades
550669-1	3-Major	K06263705	Monitors stop working - throttling monitor instance probe because file descriptor limit 65436 reached
549329-1	3-Major	K02020031	L7 mirrored ACK from standby to active box can cause tmm core on active
545450-3	3-Major		Log activation/deactivation of TM.TCPMemoryPressure
541126-4	3-Major		Safenet connection may fail on restarting pkcs11d or HSM reboot or if the connection to HSM is lost and then resumed
537553-6	3-Major		tmm might crash after modifying virtual server SSL profiles in SNI configuration
528736-1	3-Major		When tcp connection is aborting tmm can crash with "hud_oob consumed" message
525675	3-Major		SSL with forward proxy can leak memory
522310-3	3-Major		ICMP errors cause the associated FastL4/TCP connection to be reset
519746-1	3-Major		ICMP errors may reset FastL4 connections unexpectedly
518086-6	3-Major		Safenet HSM Traffic failure after system reboot/switchover
505705-7	3-Major		Expired mirrored persistence entries not always freed using intra-chassis mirroring
501984-2	3-Major		TMM may experience an outage when an iRule fails in LB_SELECTED.
500003-4	3-Major		Incoming NTP packets from configured NTP server to non-local IP breaks outgoing NTP
494977-2	3-Major		Rare outages possible when using config sync and node-based load balancing
490740-10	3-Major		TMM may assert if HTTP is disabled by another filter while it is parked
475677-3	3-Major		Connections may hang until timeout if a LTM policy action failed
464801-2	3-Major		Intermittent tmm core
442539-1	3-Major		OneConnect security improvements.
587966-3	4-Minor	K77283304	LTM FastL4 DNS virtual server: first A query dropped when A and AAAA requested at the same time with same source IP:port
574020-4	4-Minor		Safenet HSM installation script fails to install successfully if partition password contains special metacharacters (!#{}')
538708-3	4-Minor		TMM may apply SYN cookie validation to packets before generating any SYN cookies
513288-5	4-Minor		Management traffic from nodes being health monitored might cause health monitors to fail.
499795-2	4-Minor		"persist add" in server-side iRule event can result in "Client Addr" being pool member address
446830-3	4-Minor		Current Sessions stat does not increment/decrement correctly.

Global Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
603598-2	2-Critical		big3d memory under extreme load conditions
587656-3	2-Critical		GTM auto discovery problem with EHF for ID574052
587617-3	2-Critical		While adding GTM server, failure to configure new IP on existing server leads to gtmd core
613576-2	3-Major		QOS load balancing links display as gray
613045	3-Major		Interaction between GTM and 10.x LTM results in some virtual servers marked down
601180-1	3-Major	K73505027	Link Controller base license does not allow DNS namespace iRule commands.★
589256-3	3-Major		DNSSEC NSEC3 records with different type bitmap for same name.
588289-4	3-Major		GTM is Re-ordering pools when adding pool including order designation
574052-2	3-Major		GTM autoconf can cause high CPU usage for gtmd

Application Security Manager Fixes

ID Number	Severity	Solution Article(s)	Description
634001-1	2-Critical		ASM restarts after deleting a VS that has an ASM security policy assigned to it
582003-2	2-Critical		BD crash on startup or on XML configuration change
515728-5	2-Critical		Repeated BD cores.
514571-1	2-Critical		Apply policy operation hangs
511187-1	2-Critical		The BIG-IP ASM bd process may produce a core file when a large BIG-IP ASM configuration is modified on a loaded system
499347-3	2-Critical		JSON UTF16 content could be blocked by ASM as Malformed JSON
621524-3	3-Major		Processing Timeout When Viewing a Request with 300+ Violations
605921	3-Major		scriptd and mcpd cores following multiple failovers due to bd (asm)
605616-3	3-Major	K16221342	Creating 256 Fundamental Security policies will result in an out of memory error
603945-1	3-Major		BD config update should be considered as config addition in case of update failure
603479-1	3-Major		"ASM starting" while it's already running, causing the restart of all ASM daemons
602221-3	3-Major		Wrong parsing of redirect Domain
600174-1	3-Major		Wildcard "*" redirection domain cannot be deleted if list is scrollable
582683-5	3-Major		xpath parser doesn't reset a namespace hash value between each and every scan
580168-2	3-Major		Information missing from ASM event logs after a switchboot and switchboot back
576591-4	3-Major		Support for some future credit card number ranges
573406-3	3-Major		ASU cannot be completed if license was last activated more than 18 months before
559541-2	3-Major		ICAP anti virus tests are not initiated on XML with when should
553976-1	3-Major		AJAX File uploads don't work in IE (import policy doesn't work)
528071-1	3-Major		ASM periodic updates (cron) write errors to log
521204-1	3-Major		Include default values in XML Policy Export
508957-1	3-Major		ASM REST Slowness Viewing Policy List
392121-1	3-Major		TMSH Command to retrieve the memory consumption of the bd process
609496-1	4-Minor		Improved diagnostics in BD config update (bd_agent) added
603071-1	4-Minor		XHTML validation fails on obfuscated JavaScript
471766-2	4-Minor		Number of decoding passes configuration

Application Visibility and Reporting Fixes

ID Number	Severity	Solution Article(s)	Description
565085-2	3-Major		Analytics profile allows invalid combination of entities for Alerts setup
488989-3	3-Major		AVRD does not print out an error message when the external logging fails
474613-1	3-Major		Upgrading from previous versions★

Access Policy Manager Fixes

ID Number	Severity	Solution Article(s)	Description
622830	2-Critical	K20488861	LDAP type CRLDP is parsed incorrectly
622244-1	2-Critical		Edge client can fail to upgrade when always connected is selected
618324-2	2-Critical		Unknown/Undefined OPSWAT ID show up as 'Any' in APM Visual Policy Editor
617310-1	2-Critical		Edge client can fail to upgrade when Always Connected is selected★
614322-3	2-Critical	K31063537	TMM might crash during handling of RDG-RPC connection when APM is used as RD Gateway
608408-4	2-Critical		TMM may restart if SSO plugin configuration initialization fails due to internal error in tmconf library
582440-2	2-Critical		Linux client does not restore route to the default GW on Ubuntu 15.10
625376-1	3-Major		In some cases, download of PAC file by edge client may fail
623562-1	3-Major		Large POSTs rejected after policy already completed
621202-1	3-Major		Portal Access: document.write() with very long string as argument may be handled incorrectly.
620614-2	3-Major		Citrix PNAgent replacement mode: iOS Citrix receiver fails to add new store account
619879-3	3-Major		HTTP iRule commands could lead to WEBSSO plugin being invoked
617316-1	3-Major		Desktop title is garbled for Citrix Storefront integration mode with non-sta configuration
617002-3	3-Major		SWG with Response Analytics agent in a Per-Request policy fails with some URLs
616838	3-Major		Citrix Remote desktop resource custom parameter name does not accept hyphen character
614891-4	3-Major		Routing table doesn't get updated when EDGE client roams among wireless networks
613613-1	3-Major		Incorrect handling of form that contains a tag with id=action
612419-2	3-Major		APM 11.4.1 HF10 - suspected memory leak (umem_alloc_32/network access (variable))
611669-1	3-Major		Mac Edge Client customization is not applied on macOS 10.12 Sierra
610248	3-Major		IE 11 browser does not display VDI profile columns properly
610243	3-Major		HTML5 access fails for Citrix Storefront integration mode with gateway pass through authentication
610224-1	3-Major		APM client may fetch expired certificate when a valid and an expired certificate co-exist
610180-3	3-Major		SAML Single Logout is misconfigured can cause a minor memory leak in SSO plugin.
604767-4	3-Major		Importing SAML IdP's metadata on BIG-IP as SP may result in not complete configuration of IdP connector object.
603293-3	3-Major		Incorrect handling of L4 Dynamic ACL when it is processed together with L7 ACLs
601905-4	3-Major		POST requests may not be forwarded to backend server when EAM plugin is enabled on the virtual server
600116-1	3-Major		DNS resolution request may take a long time in some cases
598211-2	3-Major		Citrix Android Receiver 3.9 does not work through APM in StoreFront integration mode.
591268-3	3-Major		VS hostname is not resolvable when DNS Relay proxy is installed and running under certain conditions
583113-3	3-Major		NTLM Auth cannot be disabled in HTTP_PROXY_REQUEST event
582752-2	3-Major		Macrocall could be topologically not connected with the rest of policy.★
569309-1	3-Major		Clientside HTML parser does not recognize HTML event attributes without value
567503-5	3-Major	K03293396	ACCESS::remove can result in confusing ERR_NOT_FOUND logs
566998-2	3-Major		Edge client upgrade fails if client was configured in locked mode★
559082-1	3-Major		Tunnel details are not shown for MAC Edge client
554458	3-Major		No Session Variables displayed when click on "View Session Variables" link in APM "All Sessions" reports with reduced zeros in Session ID
509595-1	3-Major		Start uri is blank when going through portal in ie, but loads fine in firefox
451301-1	3-Major		HTTP iRules break Citrix HTML5 functionality
389484-4	3-Major		OAM reporting Access Server down with JDK version 1.6.0_27 or later
366149-1	3-Major		ACL support for VPN tunnels
238444-2	3-Major		An L4 ACL has no effect when a layered virtual server is used.
620922-1	4-Minor		Online help for Network Access needs update

WebAccelerator Fixes

ID Number	Severity	Solution Article(s)	Description
472942-2	2-Critical	K04924125	tmm crash while changing acceleration policy
596569-2	3-Major		Memory leak on Central device in Symmetric deployment
506315-5	3-Major		WAM/AAM is honoring OWS age header when not honoring OWS maxage.
474445-2	3-Major		TMM crash when processing unexpected HTTP response in WAM

Wan Optimization Manager Fixes

ID Number	Severity	Solution Article(s)	Description
619757-3	2-Critical		iSession causes routing entry to be prematurely freed

Service Provider Fixes

ID Number	Severity	Solution Article(s)	Description
607713-4	3-Major		SIP Parser fails header with multiple sequential separators inside quoted string.
601255-3	3-Major		RTSP response to SETUP request has incorrect client_port attribute
599521-2	3-Major		Persistence entries not added if message is routed via an iRule
598854-1	3-Major		sipdb tool incorrectly displays persistence records without a pool name
597835-1	3-Major		Branch parameter in inserted VIA header not consistent as per spec
583010-9	3-Major		Sending a SIP invite with "tel" URI fails with a reset

Advanced Firewall Manager Fixes

ID Number	Severity	Solution Article(s)	Description
619710	3-Major		GUI gives error when clicking "Update" making changes to VS in Security-Policies
618902-3	3-Major		PCCD memory usage increases on configuration changes and recompilation due to small amount of memory leak on each compilation
614563-1	3-Major		AVR TPS calculation is inaccurate
605427-2	3-Major		TMM may crash when adding and removing virtual servers with security log profiles
592113-1	3-Major		tmm core on the standby unit with dos vectors configured
580460-1	3-Major		Client side integrity defense or proactive may break application
495390-4	3-Major		An error occurs on Active Rules page after attempting to reorder Rules in a Policy

Policy Enforcement Manager Fixes

ID Number	Severity	Solution Article(s)	Description
553735-3	2-Critical		TMM core on HTTP response with steering action .
527992-2	2-Critical		tmm might crash with 'DHCP:dhcp_server_flow_connect' error when the server flow is already connected to a different client.
624091	3-Major		DHCP relay is not forwarding all of the DHCPOFFERS to clients
611355	3-Major		tmm core with PEM
608742-4	3-Major		DHCP: DHCP renew ack messages from server are getting dropped by BIGIP in Forward mode.
592070-1	3-Major		DHCP server connFlow when created based on the DHCP client connFlow does not have the traffic group ID copied
551303-3	3-Major	K75280116	TMM may core during processing of a CCA-T.
472122-4	3-Major		DHCPv4: When configured in forwarding mode, BIG-IP will support client messages that use either UDP 67 or 68 as the source port.

Carrier-Grade NAT Fixes

ID Number	Severity	Solution Article(s)	Description
532365-1	3-Major		lsndb cores with "Assertion `size < bin_key_size' failed"
504828-2	3-Major		"translate address" and "translate port" are enabled by default when configure from GUI
481948-1	3-Major		LSN_DELETE messages may not be logged in PBA mode

Global Traffic Manager (DNS) Fixes

ID Number	Severity	Solution Article(s)	Description
621239-1	3-Major		Certain DNS queries bypass DNS Cache RPZ filter.
620215-3	3-Major		TMM out of memory causes core in DNS cache
619398-4	3-Major		TMM out of memory causes core in DNS cache
491801	3-Major		GTM iRule command [LB::status up] gives error
615187-1	4-Minor		Missing hyperlink to GSLB virtual servers and servers on the pool member page.

Traffic Classification Engine Fixes

ID Number	Severity	Solution Article(s)	Description
615260	2-Critical		out of memory condition when URL categorization is configured to work with large feedlists

Device Management Fixes

ID Number	Severity	Solution Article(s)	Description
522268-2	2-Critical		hostagentd memory leak on VCMP hosts

Cumulative fixes from BIG-IP v11.6.1 Hotfix 1 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
596488-4	CVE-2016-5118	K82747025	GraphicsMagick vulnerability CVE-2016-5118.
591806-3	CVE-2016-3714	K03151140	ImageMagick vulnerability CVE-2016-3714
591328-2	CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109	K36488941	OpenSSL vulnerability CVE-2016-2106
591327-2	CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109	K36488941	OpenSSL vulnerability CVE-2016-2106
591325-2	CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109	K75152412	OpenSSL (May 2016) CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109
591042-5	CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109	K23230229	OpenSSL vulnerabilities
579955-2	CVE-2016-7475	K01587042	BIG-IP SPDY and HTTP/2 profile vulnerability CVE-2016-7475
577826-4	CVE-2016-1286	K62012529	BIND vulnerability CVE-2016-1286
573778-7	CVE-2016-1714	K75248350	QEMU vulnerability CVE-2016-1714
573124-2	CVE-2016-5022	K06045217	TMM vulnerability CVE-2016-5022
563670-11	CVE-2015-3194, CVE-2015-3195, CVE-2015-3196	K86772626	OpenSSL vulnerabilities
601938-3	CVE-2016-7474	K52180214	MCPD stores certain data incorrectly
593447-2	CVE-2016-5024	K92859602	BIG-IP TMM iRules vulnerability CVE-2016-5024
591918-4	CVE-2016-3718	K61974123	ImageMagick vulnerability CVE-2016-3718
591908-4	CVE-2016-3717	K29154575	ImageMagick vulnerability CVE-2016-3717
591894-4	CVE-2016-3715	K10550253	ImageMagick vulnerability CVE-2016-3715
591881-4	CVE-2016-3716	K25102203	ImageMagick vulnerability CVE-2016-3716
587077-3	CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2115 CVE-2016-2118	K37603172	Samba vulnerabilities CVE-2015-5370 and CVE-2016-2118
585424-3	CVE-2016-1979	K20145801	Mozilla NSS vulnerability CVE-2016-1979
582813-1	CVE-2016-0774	K08440897	Linux Kernel CVE-2016-0774
579220-3	CVE-2016-1950	K91100352	Mozilla NSS vulnerability CVE-2016-1950
564111-1	CVE-2015-8395 CVE-2015-8384 CVE-2015-8392 CVE-2015-8394 CVE-2015-8391 CVE-2015-8390 CVE-2015-8389 CVE-2015-8388 CVE-2015-8387 CVE-2015-8386 CVE-2015-8385 CVE-2015-8383 CVE-2015-8382 CVE-2015-8381 CVE-2015-8380 CVE-2015-2328 CVE-2015-2327 CVE-2015-8393	K05428062	Multiple PCRE vulnerabilities
541231-2	CVE-2014-3613 CVE-2014-3707 CVE-2014-8150 CVE-2015-3143 CVE-2015-3148	K16704 K16707	Resolution of multiple curl vulnerabilities
486791-2	CVE-2014-6421 CVE-2014-6422 CVE-2014-6423 CVE-2014-6424 CVE-2014-6425 CVE-2014-6426 CVE-2014-6427 CVE-2014-6428 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432	K16939	Resolution of multiple wireshark vulnerabilities
416734-1	CVE-2012-5195 CVE-2012-5526 CVE-2012-6329 CVE-2013-1667	K15867	Multiple Perl Vulnerabilities
580340-3	CVE-2016-2842	K52349521	OpenSSL vulnerability CVE-2016-2842
580313-3	CVE-2016-0799	K22334603	OpenSSL vulnerability CVE-2016-0799
579975-3	CVE-2016-0702	K79215841	OpenSSL vulnerability
579829-3	CVE-2016-0702	K79215841	OpenSSL vulnerability CVE-2016-0702
579237-3	CVE-2016-0705	K93122894	OpenSSL Vulnerability CVE-2016-0705
579085-4	CVE-2016-0797	K40524634	OpenSSL vulnerability CVE-2016-0797
578570-2	CVE-2016-0705	K93122894	OpenSSL Vulnerability CVE-2016-0705
577828-5	CVE-2016-2088	K59692558	BIND vulnerability CVE-2016-2088
577823-4	CVE-2016-1285	K46264120	BIND vulnerability CVE-2016-1285
567379-1	CVE-2013-4397	K16015326	libtar vulnerability CVE-2013-4397
565895-4	CVE-2015-3217	K17235	Multiple PCRE Vulnerabilities
553454-2	CVE-2015-2730	K15955144	Mozilla NSS vulnerability CVE-2015-2730
551287-4	CVE-2010-2596 CVE-2013-1960 CVE-2013-1961 CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244	K16715	Multiple LibTIFF vulnerabilities
481806-2	CVE-2013-4002	K16872	Java Runtime Environment vulnerability CVE-2013-4002
479431-4	CVE-2014-3596	K16821	Apache Axis vulnerability CVE-2014-3596
416372-4	CVE-2012-2677	K16946	Boost memory allocator vulnerability CVE-2012-2677
570667-16	CVE-2016-0701 CVE-2015-3197	K64009378	OpenSSL vulnerabilities
517048-1	CVE-2015-2305	K16831	BSD regex library vulnerability CVE-2015-2305

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
532685-6	3-Major		PAC file download errors disconnect the tunnel
544325-3	4-Minor	K83161025	BIG-IP UDP virtual server may not send ICMP Destination Unreachable message Code 3 (port unreachable).
483508-1	4-Minor	K70333230	Large values may display as negative numbers for 32-bit integer variables in the MIB

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
538761-4	1-Blocking		scriptd may core when MCP connection is lost
583936-3	2-Critical		Removing ECMP route from BGP does not clear route from NSM
574116-2	2-Critical		MCP may crash when syncing configuration between device groups
570973-2	2-Critical		L7 hardware syn cookie feature is broken in BIG-IP v12.0.0 hf1 and hf2
569634	2-Critical		Aced process is not able to listen to port 6000
568889-2	2-Critical	K22989000	Some ZebOS daemons do not start on blade transition secondary to primary.
563064-1	2-Critical		Bringing up and tearing down an IPsec tunnel will slowly leak tmm memory
561814-1	2-Critical		TMM Core on Multi-Blade Chassis
560683-3	2-Critical		HA IPSEC: tmm core/crash on standby in function ikev2_child_delete_outbound()
559034-1	2-Critical		Mcpd core dump in the sync secondary during config sync
557144-3	2-Critical		Dynamic route flapping may lead to tmm crash
542097-2	2-Critical		Update to RHEL6 kernel
530903-1	2-Critical		HA pair in a typical Active/Standby configuration becomes Active/Active after a software upgrade★
529141-5	2-Critical	K95285012	Upgrade from 10.x fails on valid clientssl profile with BIGpipe parsing error★
506274-2	2-Critical		TMM crash/core seen when a traffic-selector is created Action discard
493053-2	2-Critical		Route domains' firewall policies may be removed after sync
481647-5	2-Critical		OSPF daemon asserts and generates core
477611-4	2-Critical		ICMP monitor does not work on DAG Round Robin enabled VLANs
473527-2	2-Critical		IPsec interop problem when using AES-GCM.
420438-3	2-Critical		Default routes from standby system when HA is configured in NSSA
598039-3	3-Major		MCP memory may leak when performing a wildcard query
595773-3	3-Major		Cancellation requests for chunked stats queries do not propagate to secondary blades
579284	3-Major		Potential memory corruption in MCPd
576305-3	3-Major		Potential MCPd leak in IPSEC SPD stats query code
575735-2	3-Major		Potential MCPd leak in global CPU info stats code
575726-2	3-Major		MCPd might leak memory in vCMP interface stats.
575716-2	3-Major		MCPd might leak memory in VCMP base stats.
575708-2	3-Major		MCPd might leak memory in CPU info stats.
575671-2	3-Major		MCPd might leak memory in host info stats.
575660-2	3-Major	K50219995	Potential MCPd leak in TMM rollup stats stats
575649-2	3-Major		MCPd might leak memory in IPFIX destination stats query
575619-2	3-Major		Potential MCPd leak in pool member stats query code
575608-2	3-Major		MCPd might leak memory in virtual server stats query.
575595-1	3-Major		Potential MCPd leak in eviction policy stats.
575591-2	3-Major		Potential MCPd leak in IKE message stats query code
575589-1	3-Major		Potential MCPd leak in IKE event stats query code
575587-2	3-Major		Potential MCPd leak in BWC policy class stats query code
575027-2	3-Major		Tagged VLAN configurations with a cmp-hash setting for the VLAN, might result in performance issues.
574045-2	3-Major		BGP may not accept attributes using extended length
571210-4	3-Major		Upgrade, load config, or sync might fail on large configs with large objects.
571019-3	3-Major		Topology records can be ordered incorrectly.
570818-2	3-Major		Address lease-pool in IKEv2 might interfere with IKEv2 negotiations.
570053-2	3-Major	K78448635	HA peer's certkeychain of clientssl profile is unexpectedly either removed or re-named after config sync.
569356-2	3-Major	K91428939	BGP ECMP learned routes may use incorrect VLAN for nexthop
569236-4	3-Major		BIG-IP logs INVALID-SPI messages but does not remove the associated SAs.
565534-2	3-Major	K40254066	Some failover configuration items may fail to take effect
562044-2	3-Major		Statistics slow_merge option does not work
559939-2	3-Major	K30040319	Changing hostname on host sometimes causes blade to go RED / HA TABLE offline
558858-4	3-Major	K80079953	Unexpected loss of communication between slots of a vCMP Guest
558779-6	3-Major		SNMP dot3 stats occassionally unavailable
557281-2	3-Major		The audit_forwarder process fails to exit normally causing the process to consume CPU to near 100%
555039-2	3-Major	K24458124	VIPRION B2100: Increase egress traffic burst tolerance for dual CoS queue configuration
553795-4	3-Major		Differing certificate/key after successful config-sync
549971-5	3-Major		Some changes to virtual servers' profile lists may cause secondary blades to restart
548385-3	3-Major	K25231211	iControl calls that query key/cert from parent folder, and the name is missing the extension, result in incorrect results
546410-2	3-Major	K02151433	Configuration may fail to load when upgrading from version 10.x.★
545745-2	3-Major		Enabling tmm.verbose mode produces messages that can be mistaken for errors.
542860-4	3-Major		TMM crashes when IPsec SA are deleted during HA Active to Standby or vice versa event
542742-2	3-Major	K07038540	SNMP reports invalid data from global_stat, avg server-side cur_conns (for 5s, 1m, 5m).
542320-1	3-Major		no login name may appear when running ssh commands through management port
541316-3	3-Major	K41175594	Unexpected transition from Forced Offline to Standby to Active
539199-3	3-Major		HTML filter is truncating the server response when sending it to client
538133-4	3-Major		Only one action per sensor is displayed in sensor_limit_table and system_check
537326-2	3-Major		NAT available in DNS section but config load fails with standalone license
532559-4	3-Major		Upgrade fails to 11.5.0 and later if 'defaults-from none' is under profile '/Common/clientssl'.
526974-1	3-Major		Data-group member records map empty strings to 'none'.
521270-2	3-Major		Hypervisor might replace vCMP guest SYN-Cookie secrets
519081-1	3-Major		Cannot use tmsh to load valid configuration created using the GUI.
516995-3	3-Major		NAT traffic group inheritance does not sync across devices
513649-4	3-Major		Transaction validation errors on object references
512954-2	3-Major		ospf6d might leak memory distribute-list is used
511900-2	3-Major		'sessiondump -allkeys' command hangs
510580-5	3-Major		Interfaces might be re-enabled unexpectedly when loading a partition
508076-2	3-Major		Cannot successfully create a key/cert via tmsh or the GUI of the form name.key1, where extension is in the name.
504803-5	3-Major		GUI Local Traffic Pool list does not show certain Pools with name containing 'mam'.
502049-1	3-Major		Qkview may store information in the wrong format
502048-1	3-Major		Qkview may store information in the wrong format
487625-3	3-Major		Qkview might hang
486725-2	3-Major		GUI creating key files with .key extensions in the name causing errors
486712-3	3-Major		GUI PVA connection maximum statistic is always zero
485702-4	3-Major		Default SNMP community 'public' is re-added after the upgrade
484534-4	3-Major		interface STP state stays in blocked when added to STP as disabled
481696-2	3-Major		Failover error message 'sod out of shmem' in /var/log/ltm
479553-4	3-Major		Sync may fail after deleting a persistence profile
479543-6	3-Major		Transaction will fail when deleting pool member and related node
478215-2	3-Major		The command 'show ltm pool detail' returns duplicate members in some cases
477888-4	3-Major		ESP ICSA support is non-functional on versions 11.4.0 and up
455651-5	3-Major	K40300934	Improper regex/glob validation in web-acceleration and http-compression profiles
451494-2	3-Major		SSL Key/Certificate in different partition with Subject Alternative Name (SAN)
425980-3	3-Major		Blade number not displayed in CPU status alerts
421971-9	3-Major		Renewing certificates with SAN input in the GUI leads to error.
418664-4	3-Major	K21485342	Configuration utility CSRF vulnerability
405611-3	3-Major	K61045143	Configuration utility CSRF vulnerability
375246-1	3-Major		Clarification of pool member session enabling versus pool member monitor enabling
372118-3	3-Major		import_all_from_archive_file and import_all_from_archive_stream does not create file objects.
601927-3	4-Minor	K52180214	Security hardening of control plane
551481-3	4-Minor		'tmsh show net cmetrics' reports bandwidth = 0
536746-3	4-Minor	K88051173	LTM : Virtual Address List page uses LTM : Nodes List search filter.
533480-5	4-Minor	K43353404	qkview crash
532086-3	4-Minor	K68631333	Local Traffic Policy Rules Condition List select value to update with existing values.
478922-3	4-Minor		ICSA logging issues on versions 11.4.0 and later
466612-1	4-Minor		Missing sys DeviceModel OID for VIPRION C2200 chassis
487084-2	5-Cosmetic		GUI iFile delete confirmation page lists incorrect items to be deleted

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
596619	2-Critical	K00539510	Some 10.2.x client SSL configurations fail to upgrade to 11.6.1.★
579919-1	2-Critical		TMM may core when LSN translation is enabled
575011-4	2-Critical	K21137299	Memory leak. Nitrox3 Hang Detected.
565409-4	2-Critical		Invalid MSS with HW syncookies and flow forwarding
559973-2	2-Critical		Nitrox can hang on RSA verification
558612-4	2-Critical		System may fail when syncookie mode is activated
558534-3	2-Critical		The TMM may crash if http url rewrite is used with APM
549868-4	2-Critical	K48629034	10G interoperability issues reported following Cisco Nexus switch version upgrade.
534795-1	2-Critical		Swapping VLAN names in config results in switch daemon core and restart.
521548-6	2-Critical		Possible crash in SPDY
517613-1	2-Critical		ClientSSL profile might have the wrong key/certificate/chain when created with a specific set of steps
489217-1	2-Critical		"cipher" memory can leak
488686-1	2-Critical	K24980114	Large file transfer hangs when HTTP is in passthrough mode
483665-2	2-Critical		Restrict the permissions for private keys
466007-2	2-Critical		DNS Express daemon, zxfrd, can not start if it's binary cache has filled /var
459671-2	2-Critical		iRules source different procs from different partitions and executes the incorrect proc.
600535	3-Major		TMM may core while exiting if MCPD connection was previously aborted
597089-5	3-Major		Connections are terminated after 5 seconds when using ePVA full acceleration
593530-1	3-Major		In rare cases, connections may fail to expire
592854-4	3-Major		Protocol version set incorrectly on serverssl renegotiation
592784-4	3-Major		Compression stalls, does not recover, and compression facilities cease.
589223-3	3-Major		TMM crash and core dump when processing SSL protocol alert.
588442-3	3-Major		TMM can core in a specific set of conditions.
587892-1	3-Major		Multiple iRule proc names might clash, causing the wrong rule to be executed.
585412-2	3-Major		SMTPS virtual server with activation-mode allow will RST non-TLS connections with Email bodies with very long lines
583957-4	3-Major		The TMM may hang handling pipelined HTTP requests with certain iRule commands.
580303-3	3-Major		When going from active to offline, tmm might send a GARP for a floating address.
579843-3	3-Major		tmrouted may not re-announce routes after a specific succession of failover states
579371-2	3-Major	K70126130	BIG-IP may generate ARPs after transition to standby
576296-2	3-Major		MCPd might leak memory in SCTP profile stats query.
575626	3-Major	K04672803	Minor memory leak in DNS Express stats error conditions
575612-3	3-Major		Potential MCPd leak in policy action stats query code
575347-2	3-Major		Unexpected backslashes remain in monitor 'username' attribute after upgrade
572025-2	3-Major		HTTP Class profile using a path selector upgrade to a policy that does not match the entire path★
571183-2	3-Major		Bundle-certificates Not Accessible via iControl REST.
569349-2	3-Major		Packet's vlan priority is not preserved for CMP redirected flows when net cos feature is enabled
566361-8	3-Major	K11543589	RAM Cache Key Collision
563591-2	3-Major		reference to freed loop_nexthop may cause tmm crash.
563419-5	3-Major		IPv6 packets containing extended trailer are dropped
563232-2	3-Major		FQDN pool in resource prevents Access Policy Sync.
554295-3	3-Major		CMP disabled flows are not properly mirrored
551189	3-Major		Modifying an HTTP cookie value via the HTTP::cookie iRule API may yield to incorrect HTTP header data
548583-3	3-Major		TMM crashes on standby device with re-mirrored SIP monitor flows.
547657-1	3-Major		A TCL error in a DNS_RESPONSE iRule event can cause a tmm crash.
545704-2	3-Major		TMM might core when using HTTP::header in a serverside event
543993-3	3-Major		Serverside connections may fail to detach when using the HTTP and OneConnect profiles
540893-2	3-Major		Unevenly loaded tmms while using syncookies may cause occasional spurious connection resets.
540213-2	3-Major		mcpd will continually restart on newly inserted secondary blades when certain configuration exists on the primary
536191-2	3-Major		Transparent inherited TCP monitors may fail on loading configuration
534111-1	3-Major		[SSL] Config sync problems when modifying cert in default client-ssl profile
530812-1	3-Major		Legacy DAG algorithm reuses high source port numbers frequently
530795-3	3-Major		In FastL4 TCP virtual servers, ICMP might send wrong SEQ number/ACK number.
528734-2	3-Major	K04711825	TCP keeps retransmitting when ICMP Destination Unreachable-Fragmentation Required messages are received.
527742-4	3-Major	K15550890	The inherit-certkeychain field of a clientSSL profile is not synchronized correctly on a standby BIG-IP system
523513-3	3-Major		COMPRESS::enable keeps compression enabled for a subsequent HTTP request.
521711-4	3-Major	K14555354	HTTP closes connection if client sends non-keepalive request and server responds with 200 OK on One-Connect enabled virtual
521036-2	3-Major		Dynamic ARP entry may replace a static entry in non-primary TMM instances.
520405-4	3-Major		tmm restart due to oversubscribed DNS resolver
517510-1	3-Major		HTTP monitor might add extra CR/LF pairs to HTTP body when supplied
513530-4	3-Major		Connections might be reset when using SSL::disable and enable command
513319-4	3-Major		Incorrect of failing sideband connections from within iRule may leak memory
504396-2	3-Major		When a virtual's ARP or ICMP is disabled, the wrong mac address is used
503257-7	3-Major		Persistence, connection limits and HTTP::respond or HTTP::redirect may result in RST
502747-1	3-Major		Incoming SYN generates unexpected ACK when connection cannot be recycled
495588-5	3-Major		Configuration fails with Syntax Error after upgrading from pre-11.5.0 releases★
490936-2	3-Major		SSLv2/TLSv1 based handshake causing handshake failures
490174-2	3-Major		Improved TLS protocol negotiation with clients supporting TLS1.3
472748-1	3-Major		SNAT pool stats are reflected in global SNAT stats
472571-6	3-Major		Memory leak with multiple client SSL profiles.
468790-2	3-Major		Inconsistent SafeNet key deletion in BIG-IP and Safenet HSM
463202-7	3-Major		BIG-IP system drops non-zero version EDNS requests
623135	4-Minor	K68401558	BIG-IP virtual server TCP sequence numbers vulnerability (CVE-2002-1463)
572015-3	4-Minor		HTTP Class profile is upgraded to a case-insensitive policy★
532799-2	4-Minor	K14551525	Static Link route to /32 pool member can end using dst broadcast MAC
531979-3	4-Minor		SSL version in the record layer of ClientHello is not set to be the lowest supported version.
472051-1	4-Minor		Manually adding username/password in ZebOS can cause imi to core

Global Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
569972-2	2-Critical		Unable to create gtm topology records using iControl REST
569521-4	2-Critical		Invalid WideIP name without dots crashes gtmd.
539466-2	2-Critical		Cannot use self-link URI in iControl REST calls with gtm topology
569472-2	3-Major		TMM segfault in lb_why_pmbr_str after GTM/BIG-IP DNS disables a GTM pool and LB why log is enabled
561539-2	3-Major		[Upgrade] GTM pool member ratio setting to 0 is not honored when upgrading from v10.2.4 to v11.5.3.★
559975-5	3-Major		Changing the username or password used for HTTP monitor basic auth may break HTTP basic auth
517582-3	3-Major		[GUI] [GTM] Cannot delete Region if attempting to delete another region referenced by a record.
510888-1	3-Major		[LC] snmp_link monitor is not listed as available when creating link objects

Application Security Manager Fixes

ID Number	Severity	Solution Article(s)	Description
578334-3	2-Critical		Policy Import (REST, inline XML import) in HA pair (CMI) fails on the peer device, remaining with a stub (default) policy.
583686-3	3-Major		High ASCII meta-characters can be disallowed on UTF-8 policy via XML import
579524-2	3-Major		DBD::mysql::db do failed: Duplicate entry '/Common/xxx' for key 'name'
577664-2	3-Major		Policy import, to inactive policies list, results in different policies on the sync-failover peers
572922-2	3-Major		Upgrade causes an ASM subsystem error of PL_PARAM_ATTRIBUTES.★
568670-2	3-Major		ASM fails to start with error - ndefined subroutine &F5::CRC::get_crc32
559055-1	3-Major		Staging is not disabled on wildcard parameter "*" when Learn New Parameters is set to "Add All"
554324-1	3-Major	K32359424	Signatures cannot be updated after Signature Systems have become corrupted in database★
539704-2	3-Major		Large ASM REST response causes all REST to hang
531566-2	3-Major		A partial response arrives to the client when response logging is turned on
521370-3	3-Major		Auto-Detect Language policy has disallowed high ASCII meta-characters even after encoding is set to UTF-8
498433-1	3-Major		Upgrading with ASM iRule and virtual server with no websecurity profile★
521183-1	4-Minor		Upgrade from 11.2.x (or earlier) to 11.5.x/11.6.x can fail when an active DoS profile exists with 'Prevention Duration' set to a value less than 5★

Application Visibility and Reporting Fixes

ID Number	Severity	Solution Article(s)	Description
579049-1	2-Critical		TMM core due to wrong assert
578353	2-Critical		Statistics data aggregation process is not optimized
575170-3	2-Critical		Analytics reports may not identify virtual servers correctly
598909-1	3-Major		SQL produces errors. AVR does not display any statistics.
596945-2	3-Major		AVR DNS record lost after upgrade.
582029-1	3-Major		AVR might report incorrect statistics when used together with other modules.
569958-2	3-Major		Upgrade for application security anomalies
567355-1	3-Major		Scheduled report lost after loading configuration
559060-3	3-Major		AVR reads BIG-IP system's cookie incorrectly in multiple BIG-IP configuration.
557062-2	3-Major		The BIG-IP ASM configuration fails to load after an upgrade.★
525448-1	3-Major		Max TPS is always 0

Access Policy Manager Fixes

ID Number	Severity	Solution Article(s)	Description
581770-2	1-Blocking		Network Access traffic does not pass IPv6 traffic if a Network Access resource contains IPv4&IPv6
592868-4	2-Critical		Rewrite may crash processing HTML tag with HTML entity in attribute value
591117-1	2-Critical		APM ACL construction may cause TMM to core if TMM is out of memory
580817-3	2-Critical		Edge Client may crash after upgrade★
579909-2	2-Critical		Secondary MCPD exits for APM Sandbox warning improperly treated as configuration error
578844-2	2-Critical		tmm cores when switching to IPv6 virtual server while connected to IPv4 virtual server with Edge Client.
575609-3	2-Critical		Zlib accelerated compression can result in a dropped flow.
571090	2-Critical		When BIG-IP is used as SAML IdP, tmm may restart under certain conditions
562919-2	2-Critical		TMM cores in renew lease timer handler
513083-1	2-Critical		d10200: tmm core when using ASM-FPS-AVR-APM-DOS on virtual server.
511478-2	2-Critical		Possible TMM crash when evaluating expression for per-request policy agents.
428068-3	2-Critical		Insufficiently detailed causes for session deletion.
598981-2	3-Major	K06913155	APM ACL does not get enforced all the time under certain conditions
597431-4	3-Major		VPN establishment may fail when computer wakes up from sleep
596116-2	3-Major		LDAP Query does not resolve group membership, when required attribute(s) specified
592591-1	3-Major		Deleting access profile prompts for apply access policy for other untouched access profiles
592414-2	3-Major		IE11 and Chrome throw "Access denied" during access to any generic window property after document.write() into its parent has been performed
590820-2	3-Major		Applications that use appendChild() or similar JavaScript functions to build UI might experience slow performance in Microsoft Internet Explorer browser.
589794	3-Major		APD might crash if LDAP Query agent failed to retrieve primary group for a user
589118	3-Major	K81314569	Horizon View client throws an exception when connecting to Horizon 7 VCS through APM.
588888-2	3-Major	K80124134	Empty URI rewriting is not done as required by browser.
586718-3	3-Major		Session variable substitutions are logged
586006-3	3-Major		Failed to retrieve CRLDP list from client certificate if DirName type is present
585562-1	3-Major		VMware View HTML5 client shipped with Horizon 7 does not work through BIG-IP APM in Chrome/Safari
582526-2	3-Major		Unable to display and edit huge policies (more than 4000 elements)
581834-4	3-Major		Firefox signed plugin for VPN, Endpoint Check, etc
580893-1	3-Major	K08731969	Support for Single FQDN usage with Citrix Storefront Integration mode
580421-3	3-Major		Edge Client may not register DLLs correctly
577939-1	3-Major		DNS suffixes on user's machine may not be restored correctly in some cases
576069-2	3-Major		Rewrite can crash in some rare corner cases
575499-1	3-Major		VPN filter may leave renew_lease timer active after teardown
575292-4	3-Major		DNS Relay proxy service does not respond to SCM commands in timely manner
574781-2	3-Major		APM Network Access IPV4/IPV6 virtual may leak memory
573643-2	3-Major		flash.utils.Proxy functionality is not negotiated
573581-4	3-Major		DNS Search suffix are not restored properly in some cases after VPN establishment
573429-1	3-Major		APM Network Access IPv4/IPv6 virtual may leak memory
572887-2	3-Major		DNS doesn't work properly on Ubuntu 15.10 when using f5fpc CLI client
570640-2	3-Major		APM Cannot create symbolic link to sandbox. Error: No such file or directory
570064-3	3-Major		IE gives a security warning asking: "Do you want to run ... InstallerControll.cab"
567660-2	3-Major		Disabling global Auto Last Hop setting breaks APM's Remote Desktop Gateway (RDG) feature
566646-4	3-Major		Portal Access could respond very slowly for large text files when using IE < 11
565231-2	3-Major		Importing a previously exported policy which had two object names may fail
564521-3	3-Major		JavaScript passed to ExternalInterface.call() may be erroneously unescaped
564482-2	3-Major		Kerberos SSO does not support AES256 encryption
563349-4	3-Major		On MAC, Network Access proxy settings are not applied to tun adapter after VPN is established
559218-2	3-Major		Iframes could be inaccessible to a parent window on a page accessed through Portal Access
558946-4	3-Major		TMM may core when APM is provisioned and access profile is attached to the virtual
556597-5	3-Major		CertHelper may crash when performing Machine Cert Inspection
551999-2	3-Major		Edge client needs to re-authenticate after lost network connectivity is restored
551454-5	3-Major		Edge client sends repeated HTTP probe to captive portal probe URL for mis-configured server
551260-2	3-Major		When SAML IdP-Connector Single Sign On Service URL contains ampersand, redirect URL may be truncated
549086-8	3-Major		Windows 10 is not detected when Firefox is used
547546-3	3-Major		Add support for auto-update of MachineCertService
541622-6	3-Major		APD/APMD Crashes While Verifying CAPTCHA
536575-1	3-Major		Session variable report can be blank in many cases
534901-1	3-Major		VMware View HTML5 client may load/initialize with delays
534373-5	3-Major		Some Text on French Localized Edge client on windows has grammatical error
533422-2	3-Major		sessiondump is not reusing connections
528701-2	3-Major		Sessiondump does not accept single dash options
528548-2	3-Major		@import "url" is not recognized by client-side CSS patcher
525429-12	3-Major		DTLS renegotiation sequence number compatibility
519059-3	3-Major		[PA] - Failing to properly patch webapp link, link not working
516219-4	3-Major		User failed to get profile license in VIPRION 4800 chassis if slot 1 is not enabled
508337-4	3-Major		In Chrome, parent.document.write() from frame may cause errors on pages accessed through Portal Access
493106-4	3-Major		HTTP Basic authentication module logs clear text password in /var/log/apm at debug level
479715-3	3-Major		Multi-tab protection problems with multi-domain SSO
409323-3	3-Major		OnDemand cert auth redirect omits port information
584373-3	4-Minor		AD/LDAP resource group mapping table controls are not accessible sometimes
580429-5	4-Minor		CTU does not show second Class ID for InstallerControll.dll
572543-2	4-Minor		User is prompted to install components repeatedly after client components are updated.
554690-3	4-Minor		VPN Server Module generates repeated Error Log "iface eth0 "... every 2 secs
541156-2	4-Minor		Network Access clients experience delays when resolving a host

WebAccelerator Fixes

ID Number	Severity	Solution Article(s)	Description
575631-3	3-Major		Potential MCPd leak in WAM stats query code
562644-4	3-Major		TMM may crash when AAM receives a pipelining HTTP request while shutting down the connection
506557-3	3-Major	K45240941	IBR tags might occasionally be all zeroes.
501714-2	3-Major		System does not prevent low quality JPEGs from optimizing to higher quality (becoming larger) does not work when AAM image optimization enabled and JPEG quality in policy is higher than JPEGs on OWS.
476476-7	3-Major		Occasional inability to cache optimized PDFs and images

Service Provider Fixes

ID Number	Severity	Solution Article(s)	Description
578564-3	3-Major		ICAP: Client RST when HTTP::respond in HTTP_RESPONSE_RELEASE after ICAP REQMOD returned HTTP response
573075-2	3-Major		ADAPT recursive loop when handling successive iRule events
572224-4	3-Major		Buffer error due to RADIUS::avp command when vendor IDs do not match
570363-2	3-Major		Potential segfault when MRF messages cross from one TMM to another.
566576-2	3-Major		ICAP/OneConnect reuses connection while previous response is in progress
550434-5	3-Major		Diameter connection may stall if server closes connection before CER/CEA handshake completes
561500-1	4-Minor		ICAP Parsing improvement

Advanced Firewall Manager Fixes

ID Number	Severity	Solution Article(s)	Description
484013-4	2-Critical		tmm might crash under load when logging profile is used with packet classification
575571-2	3-Major		MCPd might leak memory in FW DOS SIP attack stats query.
569337-2	3-Major		TCP events are logged twice in a HA setup

Policy Enforcement Manager Fixes

ID Number	Severity	Solution Article(s)	Description
593070-5	2-Critical		TMM may crash with multiple IP addresses per session
577863-2	3-Major		DHCP relay not forwarding server DHCPOFFER and DHCPACK message after sometime
577814-4	3-Major		MCPd might leak memory in PEM stats queries.
566061-3	3-Major		Subscriber info missing in flow report after subscriber has been deleted

Carrier-Grade NAT Fixes

ID Number	Severity	Solution Article(s)	Description
515736-4	3-Major		LSN pool with small port range may not use all ports

Fraud Protection Services Fixes

ID Number	Severity	Solution Article(s)	Description
561623-3	2-Critical		Realtime encryption causes high CPU usage in older browsers
593667	3-Major		Dashboard displays incomplete alert details when Polish characters are included
583445	3-Major		Alert dashboard does not correctly display Hebrew characters in alerts.
556162-3	3-Major		Default obfuscator configuration causes very slow javascript in some browsers

Traffic Classification Engine Fixes

ID Number	Severity	Solution Article(s)	Description
595270	2-Critical		Memory leaks when session DB tables gets updated
554928-1	2-Critical		tmm eventually crashes when classification profile is configured on the virtual

Device Management Fixes

ID Number	Severity	Solution Article(s)	Description
580686-1	3-Major	K70973444	Hostagentd might leak memory on vCMP hosts.

Cumulative fixes from BIG-IP v11.6.1 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
570716-3	CVE-2016-5736	K10133477	BIG-IP IPsec IKE peer listener vulnerability CVE-2016-5736
565169	CVE-2013-5825 CVE-2013-5830	K48802597	Multiple Java Vulnerabilities
542314-5	CVE-2015-8099	K35358312	TCP vulnerability - CVE-2015-8099
572495-3	CVE-2016-5023	K19784568	TMM may crash if it receives a malformed packet CVE-2016-5023
570535	CVE-2011-5321 CVE-2012-6657 CVE-2013-4483 CVE-2014-3184 CVE-2014-3185 CVE-2014-3611 CVE-2014-3940 CVE-2014-6410 CVE-2014-8160 CVE-2014-9420 CVE-2014-9529 CVE-2014-9584 CVE-2015-1593 CVE-2015-1805 CVE-2015-3636 CVE-2015-5307 CVE-2015-5364 CVE-2015-5366 CVE-2015-7613 CVE-2015-7872 CVE-2015-8104	K15685 K15912 K31300371 K16011 K21632201 K31026324 K17239 K17543 K17121 K41739114 K17246 K17458 K17244 K17245 K90230486 K17309 K17307 K31026324 K94105604	Multiple Kernel Vulnerabilities
567475-5	CVE-2015-8704	K53445000	BIND vulnerability CVE-2015-8704
560925-2	CVE-2015-3194	K86772626	OpenSSL Vulnerability fix
560910-2	CVE-2015-3194	K86772626	OpenSSL Vulnerability fix
560180-2	CVE-2015-8000	K34250741	BIND Vulnerability CVE-2015-8000
554624-2	CVE-2015-5300 CVE-2015-7704	K10600056 K17566	NTP CVE-2015-5300 CVE-2015-7704
553902-2	CVE-2015-5300 CVE-2015-7704 CVE-2015-7871 CVE-2015-7855 CVE-2015-7853 CVE-2015-7852 CVE-2015-7850 CVE-2015-7701 CVE-2015-7691 CVE-2015-7692 CVE-2015-7702 CVE-2015-5196	K17516	Multiple NTP Vulnerabilities
546080-5	CVE-2016-5021	K99998454	Path sanitization for iControl REST worker
545786-4	CVE-2015-7393	K75136237	Privilege escalation vulnerability CVE-2015-7393
545762	CVE-2015-7394	K17407	CVE-2015-7394
540767-2	CVE-2015-5621	K17378	SNMP vulnerability CVE-2015-5621
539923-1	CVE-2016-1497	K31925518	BIG-IP APM access logs vulnerability CVE-2016-1497
534090-2	CVE-2015-5380	K17238	Node.js vulnerability CVE-2015-5380
518275-2	CVE-2016-4545	K48042976	The BIG-IP system may stop the normal processing of SSL traffic and dump a TMM core file
508057-1	CVE-2015-0411	K44611310	MySQL Vulnerability CVE-2015-0411
497065-1	CVE-2013-6435	K16383	Linux RPM vulnerability CVE-2013-6435
488015-1	CVE-2014-3669 CVE-2014-3670 CVE-2014-3668	K15866	Multiple PHP vulnerabilities
472093-1	CVE-2015-8022	K12401251	APM TMUI Vulnerability CVE-2015-8022
556383-1	CVE-2015-7181 CVE-2015-7182 CVE-2015-7183	K31372672	Multiple NSS Vulnerabilities
550596-3	CVE-2016-6876	K52638558	RESOLV::lookup iRule command vulnerability CVE-2016-6876
534633-3	CVE-2015-5600	K17113	OpenSSH vulnerability CVE-2015-5600
527762-1	CVE-2015-4000	K16674	TLS vulnerability CVE-2015-4000
525232-1	CVE-2015-4024 CVE-2014-8142	K16826	PHP vulnerability CVE-2015-4024
500089-1	CVE-2015-0206	K16124	OpenSSL vulnerability CVE-2015-0206
472696-1	CVE-2014-1544	K16716	Multiple Mozilla Network Security Services vulnerabilities
470842-1	CVE-2012-5784	K14371	Apache Axis vulnerability CVE-2012-5784
427174-7	CVE-2013-1620 CVE-2013-0791	K15630	SOL15630: TLS in Mozilla NSS vulnerability CVE-2013-1620
560969-2	CVE-2015-3196	K55540723	OpenSSL vulnerability fix
560962-2	CVE-2015-3196	K55540723	OpenSSL Vulnerability CVE-2015-3196
560948-2	CVE-2015-3195	K12824341	OpenSSL vulnerability CVE-2015-3195
527639-2	CVE-2015-1791	K16914	CVE-2015-1791 : OpenSSL Vulnerability
527638-2	CVE-2015-1792	K16915	OpenSSL vulnerability CVE-2015-1792
527637-2	CVE-2015-1790	K16898	PKCS #7 vulnerability CVE-2015-1790
527633-2	CVE-2015-1789	K16913	OpenSSL vulnerability CVE-2015-1789
500094-1	CVE-2014-3570	K16120	OpenSSL vulnerability CVE-2014-3570
500093-1	CVE-2014-8275	K16136	OpenSSL vulnerability CVE-2014-8275
500092-1	CVE-2015-0205	K16135	OpenSSL vulnerability CVE-2015-0205
500090-1	CVE-2014-3572	K16126	OpenSSL vulnerability CVE-2014-3572
494735-1	CVE-2014-3566	K15702	SSLv3 vulnerability CVE-2014-3566
479897-1	CVE-2014-2497 CVE-2014-3538 CVE-2014-3597 CVE-2014-4670 CVE-2014-4698 CVE-2014-5120 CVE-2014-0238	K15761	Multiple PHP 5.x vulnerabilities
567484-5	CVE-2015-8705	K86533083	BIND Vulnerability CVE-2015-8705

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
470715-5	2-Critical	K16019	Excessive IP fragmentation on tmm_bp vlan causes ftp data loss with vlan name >= 16 characters long
539130-6	3-Major	K70695033	bigd may crash due to a heartbeat timeout
530133-3	3-Major		Support for New Platform: BIG-IP 10350 FIPS
520277-2	3-Major		Components validation alert
497395-1	3-Major		Correctly assign severity to check component alerts
493507-1	3-Major		License checks for fictive URLs and injected tags
490537-6	3-Major	K15922	Persistence Records display in GUI might cause system crash with large number of records
382157-3	3-Major	K17163	Stats presented by the MIB sysVlanStatTable does not match sflow vlan stats

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
492460-3	1-Blocking	K17320	Virtual deletion failure possible when using sFlow
572086	2-Critical	K49725838	Unable to boot v11.6.0 on 7250 or 10250 platforms
564427-3	2-Critical		Use of iControl call get_certificate_list_v2() causes a memory leak.
562959-2	2-Critical	K37138515	In some error scenarios, IPsec might send packets not intended for the IPsec over the tunnel.
562122-5	2-Critical		Adding a trunk might disable vCMP guest
557680-1	2-Critical		Fast successive MTU changes to IPsec tunnel interface crashes TMM
556380-2	2-Critical		mcpd can assert on active connection deletion
555686-5	2-Critical		Copper SFPs OPT-0015 on 10000-series appliance may cause interfaces to not come up and/or show corrupted serial numbers
554609-4	2-Critical	K87381045	Kernel panics during boot when RAM spans multiple NUMA nodes.
552481	2-Critical		Disk provisioning error after restarting ASM service.
551661-2	2-Critical		Monitor with send/receive string containing double-quote may fail to load.
544913-6	2-Critical	K17322	tmm core while logging from TMM during failover
544481-5	2-Critical		IPSEC Tunnel fails for more than one minute randomly.
543924	2-Critical		Update kernel to latest public RHEL6.4 kernel: 2.6.32-358.61.1.el6
520380-6	2-Critical	K41313442	save-on-auto-sync can spawn multiple invocations of tmsh, starving system of memory
511527-2	2-Critical		snmpd segmentation fault at get_bigip_profile_user_stat()
510559-6	2-Critical		Add logging to indicate that compression engine is stalled.
505071-5	2-Critical		Delete and create of the same object can cause secondary blades' mcpd processes to restart.
504508-5	2-Critical	K16773	IPsec tunnel connection from BIG-IP to some Cisco ASA does not stay up when DPD (Dead Peer Detection) is enabled
503600-6	2-Critical	K17149	TMM core logging from TMM while attempting to connect to remote logging server
502841-2	2-Critical	K17580	REST API hangs due to icrd startup issues
490801-2	2-Critical		mod_ssl: missing support for TLSv1.1 and TLSv1.2
484453-6	2-Critical	K15853	Messages logged when registering with LOP daemon (lopd) or CAN daemon (cand)
365219-2	2-Critical		Trust upgrade fails when upgrading from version 10.x to version 11.x.★
606540-1	3-Major	K33064211	DB variable changed via GUI does not sync across HA group
567774-1	3-Major		ca-devices and non-ca-devices addition/deletion has been removed from restart cm trust-domain Root
563475-3	3-Major	K00301400	ePVA dynamic offloading can result in immediate eviction and re-offloading of flows.
562928	3-Major		Curl connections with 'local-port' option fail sometimes over IPsec tunnels when connection.vlankeyed db variable is disabled
560423-2	3-Major		VxLAN tunnel IP address modification is not supported
560220-1	3-Major		Missing partition and subPath fields for some objects in iControl REST
559584-2	3-Major	K23410869	tmsh list/save configuration takes a long time when config contains nested objects.
558573-2	3-Major	K65352421	MCPD restart on secondary blade after updating Pool via GUI
556284-5	3-Major	K55622762	iqsyncer: GTM/LC config sync failure with error from local mcpd Monitor parent not found
555905-3	3-Major		sod health logging inconsistent when device removed from failover group or device trust
554563-3	3-Major		Error: Egress CoS queue packet drop counted against both Drops In and Drops Out statistics.
554340-4	3-Major		IPsec tunnels fail when connection.vlankeyed db variable is disabled
553649-3	3-Major		The SNMP daemon might lock up and fail to respond to SNMP requests.
553576-3	3-Major	K17356	Intermittent 'zero millivolt' reading from FND-850 PSU
552585-3	3-Major	K32030059	AAA pool member creation sets the port to 0.
551927-2	3-Major		ePVA snoop header's transform vlan should be set properly under asymmetric routing condition
551742-2	3-Major		Hardware parity error mitigation for the SOURCE_VP table on 10000s/10200v/10250v platforms and B4300/B4340N and B2250 blades
550694-3	3-Major	K60222549	LCD display stops updating and Status LED turns/blinks Amber
550536-3	3-Major		Incorrect information/text (in French) is displayed when the Edge Client is launched
549543-3	3-Major	K37436054	DSR rejects return traffic for monitoring the server
548239-3	3-Major	K04844213	BGP routing using route-maps cannot match route tags
547532-2	3-Major		Monitor instances in a partition that uses a non-default route domain can fail validation on secondary blades
541569-3	3-Major	K59519340	IPsec NAT-T (IKEv1) not working properly
540996-2	3-Major		Monitors with a send attribute set to 'none' are lost on save
540871-1	3-Major	K01418954	Update/deletion of SNMPv3 user does not work correctly
539822-4	3-Major		tmm may leak connflow and memory on vCMP guest.
539784-4	3-Major		HA daemon_heartbeat mcpd fails on load sys config
538663-3	3-Major		SSO token login does not work due to remote role update failures.
538024-3	3-Major	K60507424	Configuration containing a virtual server with a named wildcard destination address ('any6') may fail to load
534582-4	3-Major	K10397582	HA configuration may fail over when standby has only base configuration loaded.
534076-2	3-Major	K34873265	SNMP configured trap-source might not be used in v1 snmp traps.
533826-5	3-Major		SNMP Memory Leak on a VIPRION system.
531986-3	3-Major		Hourly AWS VE license breaks after reboot with default tmm route/gateway.
531705-2	3-Major	K53725847	List commands on non-existent iRules incorrectly succeeds.
530242-3	3-Major	K08654415	SPDAG on VIPRION B2250 blades might cause traffic imbalance among TMMs
529977-1	3-Major		OSPF may not process updates to redistributed routes
529484-4	3-Major		Virtual Edition Kernel Panic under load
528987-3	3-Major		Benign warning during formatting installation
528276-7	3-Major	K39167163	The device management daemon can crash with a malloc error
526817-4	3-Major		snmpd core due to mcpd message timer thread not exiting
526031-2	3-Major	K38429933	OSPFv3 may not completely recover from "clear ipv6 ospf process"
524300-2	3-Major	K71003856	The MOS boot process appears to hang.
523867-3	3-Major		'warning: Failed to find EUDs' message during formatting installation
522871-1	3-Major	K13764703	[TMSH] nested wildcard deletion will delete all the objects (matched or not matched)
522837-1	3-Major		MCPD can core as a result of another component shutting down prematurely
522332-1	3-Major	K81374736	Configuration upgrade of httpclass which has the 'hosts' attribute done incorrectly★
521144-5	3-Major	K16799	Network failover packets on the management interface sometimes have an incorrect source-IP
517388-7	3-Major		Parsing the DN (for subject or issuer) in a certificate does not take into account all the possible RDNs.
517209-7	3-Major	K81807474	tmsh save sys config file /var/tmp or /shared/tmp can make some BIG-IP functionality unusable
517020-5	3-Major		SNMP requests fail and subsnmpd reports that it has been terminated.
516322-7	3-Major		The BIG-IP system may erroneously remove an iApp association from the virtual server.
513974-7	3-Major	K16691	Transaction validation errors on object references
513659-3	3-Major	K72841425	AAM Policy not all regex characters can be used via the GUI
512130-4	3-Major		Remote role group authentication fails with a space in LDAP attribute group name
510381-3	3-Major		bcm56xxd might core when restarting due to bundling config change.
503246-4	3-Major		TMM crashes when unable to allocate large amount of provisioned memory
496679-5	3-Major		Configuration loads may fail because the 'default-device' on a traffic-group object does not contain a valid value.★
495865-2	3-Major	K15116582	iApps/tmsh cannot reconfigure pools that have monitors associated with them.
491727-2	3-Major	K17029	Upgrade can fail to load config due to tcp profile no longer allowing time-wait-timeout of 4294967295 (indefinite).★
482373-3	3-Major		Can not delete and re-create a new virtual server that uses the same virtual address in the same transaction
480246-4	3-Major	K17080	Message: Data publisher not found or not implemented when processing request
473415-1	3-Major	K93511901	ASM Standalone license has to include URL and HTML Rewrite★
449453-5	3-Major	K17368	Loading the default configuration may cause the mcpd process to restart and produce a core file.
439559-2	3-Major	K16262	APM policy sync resulting in failover device group sync may make the failover sync fail
433466-4	3-Major		Disabling bundled interfaces affects first member of associated unbundled interfaces
421012-3	3-Major	K73028377	scriptd incorrectly reports that it is running on a secondary blade
405635-2	3-Major		Using the restart cm trust-domain command to recreate certificates required by device trust.
553174-4	4-Minor		Unable to query admin IP via SNMP on VCMP guest
533790-4	4-Minor		Creating multiple address entries in data-group might result in records being incorrectly deleted
519216-4	4-Minor		Abnormally high CPU utilization from external SSL/OpenSSL monitors
480071-2	4-Minor	K75451516	Backslashes in policy rule added/duplicated when modified in GUI.
401893-3	4-Minor		Allowing tilde in HTTP Profile fields Response Headers Allowed and Encrypt Cookies
223884	4-Minor		Module not licensed message appears when APM is provisioned and APML is licensed.
572133-2	5-Cosmetic		tmsh save /sys ucs command sends status messages to stderr
413708-5	5-Cosmetic	K31302478	BIG-IP system may use an ephemeral source port when sending SNMP IPv6 UDP response.
388274-3	5-Cosmetic		LTM pool member link in a route domain is wrong in Network Map.
291469-2	5-Cosmetic	K10643	SNMP query fails to return ARP entries when the ARP table exceeds 2,048 entries.

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
536690-4	1-Blocking	K82591051	Occasional host-tmm connections within a chassis will fail (affects APM processes trying to connect to a tmm)
476386-2	1-Blocking		DHE-RSA-AES256-SHA256 and DHE-RSA-AES128-SHA256 should only be supported for tls1.2
576314-2	2-Critical		SNMP traps for FIPS device fault inconsistent among versions.
565810-2	2-Critical	K93065637	OneConnect profile with an idle or strict limit-type might lead to tmm core.
562566-2	2-Critical	K39483533	High Availability connection flap may cause mirrored persistence entries to be retained after expiration on multi-blade systems
554967-3	2-Critical		Small Client EDNS0 Limits can Sometimes Truncate DNSSEC or iRule DNS Packets
552151-2	2-Critical		Continuous error report in /dev/log/ltm: Device error: n3-compress0 Nitrox 3, Hang Detected
549782-1	2-Critical		XFV driver can leak memory
545810-1	2-Critical		ASSERT in CSP in packet_reuse
544375-1	2-Critical		Unable to load certificate/key pair
542564-3	2-Critical		bigd detection and logging of load and overload
540568-2	2-Critical		TMM core due to SIGSEGV
540473-6	2-Critical		peer/clientside/serverside script with parking command may cause tmm to core.
537988-5	2-Critical	K76135297	Buffer overflow for large session messages
534804-2	2-Critical		TMM may core with rate limiting enabled and service-down-action reselect on poolmembers
534052-3	2-Critical	K17150	VLAN failsafe triggering on standby leaks memory
530505-4	2-Critical		IP fragments can cause TMM to crash when packet filtering is enabled
529920-7	2-Critical		Connection mirroring with OneConnect on a virtual server can cause TMM crash on standby unit
528739-1	2-Critical	K47320953	DNS Cache might use cached data from ADDITIONAL sections in ANSWER responses.
527011-6	2-Critical		Intermittent lost connections with no errors on external interfaces
525882-2	2-Critical	K29113720	SSL client certificate verification during SSL handshake might leak a reference to the issuer certificate.
524605-2	2-Critical	K55311422	Requests/responses may not be fully delivered to plugin in some circumstances
523995-2	2-Critical		IPv4 link-local addresses can cause TMM crash when used in conjunction with ECMP routes
521336-6	2-Critical		pkcs11d initialization retry might post misleading error messages and eventually result in a pkcs11d core
520105-3	2-Critical		Possible segfault during hardware accelerated compression.
517465-4	2-Critical		tmm crash with ssl
509284-2	2-Critical		Improved reliability of a module interfacing with HSM
507611-4	2-Critical	K17151	On BIG-IP 2000- and 4000-series platforms BGP sessions with TCP MD5 enabled might fail to establish connection to neighbors.
489451-3	2-Critical	K17278	TMM might panic due to OpenSSL failure during handshake generation
489329-6	2-Critical		Memory corruption can occur with SPDY/HTTP2 profile(s)
484214-2	2-Critical		Nitrox got stuck when processed certain SSL records
483719-2	2-Critical	K16260	vlan-groups configured with a single member VLAN result in memory leak
341928-4	2-Critical	K16482	CMP enabled virtual servers which target CMP disabled virtual servers can crash TMM.
570617-4	3-Major		HTTP parses fragmented response versions incorrectly
564371-2	3-Major		FQDN node availability not reset after removing monitoring
562308-2	3-Major		FQDN pool members do not support manual-resume
562292-1	3-Major		Nesting periodic after with parking command could crash tmm
560685	3-Major		TMM may crash with 'tmsh show sys conn'.
559933-2	3-Major	K83032815	tmm might leak memory on vCMP guest in SSL forward proxy
558517-3	3-Major		Upgrading results in additional escaping for monitor send/recv strings in /config/bigip.conf.★
557783-2	3-Major	K14147369	TMM generated traffic to external IPv6 global-addr via ECMP routes might use link-local addr
556568-2	3-Major		TMM can crash with ssl persistence and fragmented ssl records
556560-2	3-Major	K80741043	DNS messages may become malformed if the Additional section contains an OPT record followed by multiple records.
556103-3	3-Major		Abnormally high CPU utilization for external monitors
554769-4	3-Major		CPM might crash when TCLRULE_HTTP_RESPONSE is triggered.
554761-5	3-Major		Unexpected handling of TCP timestamps under syncookie protection.
553688-4	3-Major		TMM can core due to memory corruption when using SPDY profile.
553613-3	3-Major		FQDN nodes do not support session user-disable
552931-4	3-Major		Configuration fails to load if DNS Express Zone name contains an underscore
552865-4	3-Major	K34035224	SSL client authentication should ignore invalid signed Certificate Verify message when PCM is set to 'request'.
550782-4	3-Major		Cache Lookups for Validating Resolvers ignore the query's DNSSEC OK (DO) bit
550689-2	3-Major		Resolver H.ROOT-SERVERS.NET Address Change
549800-2	3-Major	K53086012	Renaming a virtual server with an attached plugin can cause buffer overflow
549406-5	3-Major	K63010180	Destination route-domain specified in the SOCKS profile
548680-2	3-Major		TMM may core when reconfiguring iApps that make use of iRules with procedures.
548678-2	3-Major		ASM blocking page does not display when using SPDY profile
548563-2	3-Major		Transparent Cache Messages Only Updated with DO-bit True
547732-1	3-Major		TMM may core on using SSL::disable on an already established serverside connection
544028-5	3-Major	K21131221	Verified Accept counter 'verified_accept_connections' might underflow.
543220-1	3-Major	K12153351	Global traffic statistics does not include PVA statistics
542724-1	3-Major	K29441414	If there is OCSP Stapling enabled on a clientSSL profile, under certain remote conditions, TMM could crash
542640-2	3-Major		bigd intentionally cores when it should shutdown cleanly
541571-3	3-Major	K97140208	FQDN ephemeral nodes not repopulated after recreating with swapped IP addresses
538639-3	3-Major		P-256 ECDH performance improvements
538603-2	3-Major	K03383492	TMM core file on pool member down with rate limit configured
537964-4	3-Major	K17388	Monitor instances may not get deleted during configuration merge load
535759-3	3-Major	K99840695	SMTP monitor might mark the server down even if the server answers the HELO message.
534457-2	3-Major		Dynamically discovered routes might fail to remirror connections.
533820-5	3-Major		DNS Cache response missing additional section
532911-2	3-Major	K03753124	Setting 'Untrusted Certificate Response Control' to ignore in server SSL profile does not ignore self-signed untrusted certificates.
532107-2	3-Major	K16716213	[LTM] [DNS] Maximum RTT value for nameserver cache still exists after nameserver cache is deleted
530761-1	3-Major		TMM crash in DNS processing on a TCP virtual
529899-1	3-Major		Installation may fail with the error "(Storage modification process conflict.)".★
528407-4	3-Major	K72235143	TMM may core with invalid lasthop pool configuration
528007-6	3-Major		Memory leak in ssl
527149-3	3-Major	K57034242	FQDN template node transitions to 'unknown' after configuration reload
527027-4	3-Major		DNSSEC Unsigned Delegations Respond with Parent Zone Information
527024-3	3-Major		DNSSEC Unsigned Delegations Respond with Parent Zone Information
525989-2	3-Major	K17165	A disabled blade is spontaneously re-enabled
525958-11	3-Major		TMM may crash if loadbalancing to node's IP in iRule routed towards an unreachable nexthop.
525672-2	3-Major		tmm memory leak with SSL forward proxy virtual server having CLIENTSSL_CLIENTHELLO with SNI lookup.
525322-7	3-Major		Executing tmsh clientssl-proxy cached-certs crashes tmm
524960-2	3-Major	K17434	'forward' command does not work if virtual server has attached pool
524641-1	3-Major	K11504283	Wildcard NAPTR record after deleting the NAPTR records
523471-2	3-Major		pkcs11d core when connecting to SafeNet HSM
519217-4	3-Major	K89004553	tmm crash: valid proxy
517282-7	3-Major	K63316585	The DNS monitor may delay marking an object down or never mark it down
517053-2	3-Major		bigd detection and logging of load and overload
516816-4	3-Major		RSA key with DSA-signed or ECDSA-signed certificate silently fails handshake.
515759-3	3-Major	K92401129	Configuration objects with more than four vlans in vlan list may cause memory utilization to increase over time
513213-5	3-Major		FastL4 connection may get RSTs in case of hardware syncookie enabled.
513142-3	3-Major		FQDN nodes with a default monitor may cause configuration load failure
512119-2	3-Major		Improved UDP DNS packet truncation
511057-5	3-Major	K60014038	Config sync fails after changing monitor in iApp
510264-1	3-Major		TMM core associated with smtps profile.
509641-3	3-Major	K46511710	Ephemeral pool members may not inherit attributes from FQDN parent
507410-2	3-Major		Possible TMM crash when handling certain types of traffic with SSL persistence enabled
507109-4	3-Major		inherit-certkeychain attribute of child Client SSL profile can unexpectedly change during upgrade★
505089-4	3-Major		Spurious ACKs result in SYN cookie rejected stat increment.
504545-2	3-Major	K17419	FQDN: node without service checking reported as 'service checking enabled, no results yet'
502480-1	3-Major		Mirrored connections on standby device do not get closed when Verified Accept is enabled
500786-6	3-Major		Heavy memory usage while using fastL4/BIGTCP virtual with HTTP profile
499430-2	3-Major	K16623	Standby unit might bridge network ingress packets when bridge_in_standby is disabled
488921-2	3-Major		BIG-IP system sends unnecessary gratuitous ARPs
476567-5	3-Major	K16561	fastL4: acceleration state is incorrectly reported on show sys conn
476564-5	3-Major	K16884	ePVA FIX: no RST for an unaccelerated flow targeting a network virtual
475701-2	3-Major		FastL4 with FIX late-bind enabled may not honor client-timeout
472532-4	3-Major		Cipher dhe-rsa-aes256-sha256 is missing from the SSL cipher list
460946-2	3-Major		NetHSM key is displayed as normal in GUI
458348-2	3-Major		RESOLV:: iRule commands and sFlow don't function correctly when using non-default CMP hashing.
455762-1	3-Major	K17094	DNS cache statistics incorrect
452443-2	3-Major		DNS cache resolver cannot send egress traffic on a VLAN with src-ip or dst-ip cmp hash configured
452439-5	3-Major	K15574	TMM may crash when enabling DOS sweep/flood if a TMM process has multiple threads
446526-7	3-Major		TCP virtual server/UDP virtual server without datagram-LB mode enabled running DNS cache and suspending iRules might cause TMM crash.
441058	3-Major	K17366	TMM can crash when a large number of SSL objects are created
424831-6	3-Major	K14573	State Mirroring does not work for an HA pair that uses only hardwired (serial) failover, without network failover
418890-2	3-Major	K92193116	OpenSSL bug can prevent RSA keys from rolling forward★
406001-3	3-Major		Host-originated traffic cannot use a nexthop in a different route domain
372473-2	3-Major		mcp error 0x1020003 may be logged to /var/log/tmm when TMM crashes
554774-2	4-Minor	K85545015	Persist lookup across services might fail to return a matching record when multiple records exist.
551614-2	4-Minor	K10607444	MTU Updates should erase all congestion metrics entries
546747-2	4-Minor	K72042050	SSL connections may fail with a handshake failure when the ClientHello is sent in multiple packets
541134-2	4-Minor	K51114681	HTTP/HTTPS monitors transmit unexpected data to monitored node.
534458-6	4-Minor	K17196	SIP monitor marks down member if response has different whitespace in header fields.
452482-7	4-Minor	K16014	HTTP virtual servers with cookie persistence might reset incoming connections
558053-2	5-Cosmetic		Pool's 'active_member_cnt' attribute may not be updated as expected.
529897-1	5-Cosmetic		Diameter monitor logging displays hex when monitor failing instead of the AVP which the monitor is failing on.

Performance Fixes

ID Number	Severity	Solution Article(s)	Description
489816-1	1-Blocking		F5 Enterprise MIB attribute sysTmmStatMemoryTotal returning zero★
548796-2	2-Critical		Avrd is at CPU is 100%

Global Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
533658-5	2-Critical		DNS decision logging can trigger TMM crash
471467	2-Critical		gtmparse segfaults when loading wideip.conf because of duplicate virtual server names
469033	2-Critical		Large big3d memory footprint.
551767-3	3-Major	K03432500	GTM server 'Virtual Server Score' not showing correctly in TMSH stats
546640	3-Major		tmsh show gtm persist <filter option> does not filter correctly
529460-7	3-Major	K17209	Short HTTP monitor responses can incorrectly mark virtual servers down.
526699-6	3-Major	K40555016	TMM might crash if BIG-IP DNS iRule nodes_up references invalid IP/Port.
481328-2	3-Major	K50139533	Many 'tmsh save sys config gtm-only partitions all' stack memory issue.
552352-2	4-Minor	K18701002	tmsh list display incorrectly for default values of gtm listener translate-address/translate-port
494796	4-Minor		Unable to create GTM Listener with non-default protocol profile.

Application Security Manager Fixes

ID Number	Severity	Solution Article(s)	Description
565463-2	1-Blocking		ASM-config consumes 1.3GB RAM after repeated Policy Import via REST
566758-2	2-Critical		Manual changes to policy imported as XML may introduce corruption for Login Pages
555057-3	2-Critical		ASM REST: Removing a Signature Set From One Security Policy Removes It From All Security Policies.
555006-3	2-Critical		ASM REST: lastUpdateMicros is not updated when changing a Custom Signature
552139-2	2-Critical	K61834804	ASM limitation in the pattern matching matrix builtup
478351-1	2-Critical	K17319	Changing management IP can lead to bd crash
475551-1	2-Critical		Flaw in CSRF protection mechanism
474252-1	2-Critical	K17344	Applying ASM security policy repeatedly fills disk partition on a chassis
574451-2	3-Major	K90243258	ASM chassis sync occasionally fails to load on secondary slot
563237	3-Major		ASM REST: name for ipIntelligenceReference is incorrect
562775-2	3-Major		Memory leak in iprepd
558642-1	3-Major		Cannot create the same navigation parameter in two different policies
554367-1	3-Major		BIG-IQ ASM remote logger: Requests are not be logged.
553146-2	3-Major	K95632194	BD memory leak
547000-4	3-Major	K47219203	Enforcer application might crash on XML traffic when out of memory
542511-2	3-Major	K97242554	'Unhandled keyword ()' error message in GUI and/or various ASM logs
541852-1	3-Major		ASM REST: PATCH to XML Profiles with unmodified "validationFiles" fails
541406-1	3-Major		ASM REST: XML Profile Validation File Associations are Removed on a Partial PATCH Request
540390-2	3-Major		ASM REST: Attack Signature Update cannot roll back to older attack signatures
538195-1	3-Major		Incremental Manual sync does not allow overwrite of 'newer' ASM config
535188-3	3-Major		Response Pages custom content with \n instead of \r\n on policy import.
534246-2	3-Major		rest_uuid should be calculated from the actual values inserted to the entity
531809-2	3-Major		FTP/SMTP traffic related bd crash
530598-1	3-Major		Some Session Tracking data points are lost on TMM restart
529610-1	3-Major	K32565535	On HA setups ASM session tracking page display an empty list when in fact there are asm entries in session db
529535-4	3-Major		MCP validation error while deactivating a policy that is assigned to a virtual server
526162-7	3-Major	K52335623	TMM crashes with SIGABRT
520732-3	3-Major		XML policy import adds default entities if the relevant element list (in policy xml doc) is specified and empty
514313-1	3-Major	K00884154	Logging profile configuration is updated unnecessarily
514061-4	3-Major	K17562	False positive scenario causes SMTP transactions to hang and eventually reset.
503696-1	3-Major		BD enforcer updates may be stuck after BD restart
491371-1	3-Major	K17285	CMI: Manual sync does not allow overwrite of 'newer' ASM config
491352-3	3-Major		Added ASM internal parameter to add more XML memory
481530-1	3-Major	K86019555	Signature reporting details for sensitive data violation
538837-1	4-Minor		REST: Filtering login pages or parameters by their associated URL does not work

Application Visibility and Reporting Fixes

ID Number	Severity	Solution Article(s)	Description
529900-1	2-Critical	K88373692	AVR missing some configuration changes in multiblade system
519257-2	2-Critical		cspm script isn't injected in text/html chuncked response
470559	2-Critical		TMM crash after traffic stress with rapid changes to Traffic capturing profiles
552488-1	3-Major	K73600514	Missing upgrade support for AFM Network DoS reports.★
549393-3	3-Major	K73435148	SWG URL categorization may cause the /var/lib/mysql file system to fill.
535246-6	3-Major	K17493	Table values are not correctly cleaned and can occupy entire disk space.
530952-1	3-Major		MySql query fails with error number 1615 'Prepared statement needs to be re-prepared'
529903-1	3-Major		Incorrect reports on multi-bladed systems
528031-3	3-Major	K10097225	AVR not reporting the activity of standby systems.
491185-1	3-Major		URL Latencies page: pagination limited to 180 pages
490999-2	3-Major		Subscriber-level AVR statistics display the subscriber-type as "Unknown" for subscribers created using Radius Acct-Start
537435-1	4-Minor		Monpd might core if asking for export report by email while monpd is terminating
495744-1	4-Minor		Some user defined ASM reports are not loading correctly after upgrade from 11.4 upwards★

Access Policy Manager Fixes

ID Number	Severity	Solution Article(s)	Description
553330-3	1-Blocking		Unable to create a new document with SharePoint 2010
579559-2	2-Critical		DTLS Networks Access may not work with some hardware platforms with Nitrox hardware acceleration
572563-3	2-Critical		PWS session does not launch on Internet Explorer
569306-3	2-Critical		Edge client does not use logon credentials even when "Reuse Windows Logon Credentials" is selected
565056-3	2-Critical	K87617654	Fail to update VPN correctly for non-admin user.
555507-2	2-Critical	K88973987	Under certain conditions, SSO plugin can overrun memory not owned by the plugin.
555272-8	2-Critical		Endpoint Security client components (OPSWAT, EPSEC) may fail to upgrade★
551764-3	2-Critical	K14954742	[APM] HTTP status 500 response of successful Access Policy in clientless mode on chassis platform
530622-1	2-Critical		EAM plugin uses high memory when serving very high concurrent user load
522997-3	2-Critical	K52553016	Websso cores when it tries to shutdown
491080-5	2-Critical	K92821195	Memory leak in access framework
571003-1	3-Major		TMM Restarts After Failover
570563-2	3-Major	K35470551	CRL is not being imported/exported properly
569255-3	3-Major	K81130213	Network Access incorrectly manipulates routing table when second adapter being connected if "Allow Local subnet access' is set to ON
566908-5	3-Major	K54435973	Webserver listening on local Wifi or ethernet IP cannot be accessed after VPN with proxy.pac file
565527-3	3-Major	K94548429	Static proxy settings are not applied if NA configuration
564496-3	3-Major		Applying APM Add-on License Does Not Change Effective License Limit
564493	3-Major	K74284318	Copying an access profile appends an _1 to the name.
564262-4	3-Major	K21518043	Network Access does not work if DNS cannot be resolved on client and PAC file contains DNS resolution code
564253-5	3-Major		Firefox signed plugin for VPN, Endpoint Check, etc
563474-2	3-Major	K51244380	SNMP F5-BIGIP-APM-MIB::apmPmStatConfigSyncState returns 0 for edited access profile
561976	3-Major	K55561335	Values of high-water and low-water mark for 'apd' pending request queue might not handle requests completely.
558870-3	3-Major	K12012384	Protected workspace does not work correctly with third party products
558631-2	3-Major	K81306414	APM Network Access VPN feature may leak memory
555457-5	3-Major	K16415235	Reboot is required, but not prompted after F5 Networks components have been uninstalled
555435-2	3-Major	K34742242	AD Query fails if cross-domain option is enabled and administrator's credentials are not specified
554993-2	3-Major		Profile Stats Not Updated After Standby Upgrade Followed By Failover
554899-2	3-Major	K57540380	MCPD core with access policy macro during config sync in HA configuration
554626-1	3-Major	K14263316	Database logging truncates log values greater than 1024
554228-5	3-Major		OneConnect does not work when WEBSSO is enabled/configured.
554041-5	3-Major		No connectivity inside enterprise network for "Always Connected" client if Network Location Awareness is enabled
553734-1	3-Major		Issue with assignment of non-string value to Form.action in javascript.
553063-1	3-Major		Epsec version rolls back to previous version on a reboot
552498-1	3-Major		APMD basic authentication cookie domains are not processed correctly
549588-2	3-Major		EAM memory leak when cookiemap is destroyed without deleting Cookie object in it
549108-1	3-Major	K52519223	RDP resource 'Custom parameters' fail to accept parameters containing spaces or colon in the value
548361	3-Major		Performance degradation when adding VDI profile to virtual server
543222-3	3-Major		apd may crash if an un-encoded session variable contains "0x"
539270-6	3-Major		A specific NTLM client fails to authenticate with BIG-IP
539229-7	3-Major		EAM core while using Oracle Access Manager
531983-5	3-Major		[MAC][NA] Routing table is not updated correctly in connected state when new adapter is added
528808-3	3-Major		Source NAT translation doesn't work when APM is disabled using iRule
526637-4	3-Major		tmm crash with APM clientless mode
522791-2	3-Major	K45123459	HTML rewriting on client might leave 'style' attribute unrewritten.
520088-2	3-Major		Citrix HTML5 Receiver does not properly display initial tour and icons
518550-3	3-Major		Incorrect value of form action attribute inside 'onsubmit' event handler in some cases
517846-2	3-Major	K25627866	View Client cannot change AD password in Cross Domain mode
511893-5	3-Major		Client connection timeout after clicking Log In to Access Policy Manager on a Chassis
492122-5	3-Major	K42635442	Now Windows Logon Integration does not recreate temporary user for logon execution each time
488811-5	3-Major		F5-prelogon user profile folder are not fully cleaned-up
482177-4	3-Major	K16777	Accessing Sharepoint web application portal interferes with IdP initiated SAML SSO
472446-2	3-Major		Customization group template file might cause mcpd to restart
471318-1	3-Major	K22671941	AD/LDAP group name matching should be case-insensitive
467256-2	3-Major	K25633150	Deleting OPSWAT/Epsec packages from GUI does not delete files from disk causing UCS packages to bloat
462598-4	3-Major	K17184	Failover triggered due to a TMM crash resulting from unavailable APM renderer pool members.
462258-8	3-Major		AD/LDAP server connection failures might cause apd to stop processing requests when service is restored
461084-3	3-Major	K48281763	Kerberos Auth might fail if client request contains Authorization header
389328-7	3-Major		RSA SecurID node secret is not synced to the standby node

WebAccelerator Fixes

ID Number	Severity	Solution Article(s)	Description
551010-7	3-Major		Crash on unexpected WAM storage queue state
525478-2	3-Major	K80413728	Requests for deflate encoding of gzip documents may crash TMM

Wan Optimization Manager Fixes

ID Number	Severity	Solution Article(s)	Description
552198-5	3-Major		APM App Tunnel/AM iSession Connection Memory Leak
547537-3	3-Major		TMM core due to iSession tunnel assertion failure

Service Provider Fixes

ID Number	Severity	Solution Article(s)	Description
538784-3	3-Major	K91532102	ICAP implementation incorrect when HTTP request or response is missing a payload
523854-1	3-Major	K35305250	TCP reset with RTSP Too Big error when streaming interleaved data
545985-3	4-Minor		ICAP 2xx response (except 200, 204) is treated as error

Advanced Firewall Manager Fixes

ID Number	Severity	Solution Article(s)	Description
561433-3	3-Major		TMM Packets can be dropped indiscriminately while under DOS attack
489379-1	3-Major		Bot signature is not matched

Policy Enforcement Manager Fixes

ID Number	Severity	Solution Article(s)	Description
529634-2	2-Critical		Crash observed with HSL logging
512069-2	2-Critical		TMM restart while relicensing the BIG-IP using the base license.
510923-2	2-Critical		TMM crashes on the disabled secondary blade and bigstart restart or reboot is triggered.
565765-3	3-Major		Flow reporting does not occur for unclassified flows.
564263-3	3-Major		PEM: TMM asserts when Using Debug Image when Gy is being used
560607-3	3-Major		Resource Limitation error when removing predefined policy which has multiple rules
559382-1	3-Major		Subscriber ID type should be set to NAI over Diameter for DHCP discovered subscribers
557675-3	3-Major		Failover from PEM to PCRF can cause session lookup inconsistency
549283-3	3-Major		Add a log message to indicate transition in the state of Gx and Gy sessions.

Carrier-Grade NAT Fixes

ID Number	Severity	Solution Article(s)	Description
555369-3	2-Critical	K43151094	CGNAT memory leak when non-TCP/UDP traffic directed at public addresses
545783-3	2-Critical		TMM crashes when forwarding an inbound connection on Large Scale NAT (LSN) pool
540571-2	2-Critical		TMM cores when multicast address is set as destination IP via iRules and LSN is configured
540484-2	2-Critical	K04005785	"show sys pptp-call-info" command can cause tmm crash
535101-1	2-Critical		Connections to LSN pools in PBA mode may cause tmm core if used in conjunction with udp_gtm_dns profile.

Fraud Protection Services Fixes

ID Number	Severity	Solution Article(s)	Description
564039-3	2-Critical		WebSafe "Missing component" check gets applied on request with different referrer domain.
563554-3	2-Critical		Accept-language in alerts
559129-3	2-Critical		Update Generic Malware Signatures to detect new Dyre variant
554540	2-Critical		RAT detection failure
554537-2	2-Critical		Failed alerts on Internet Explorer
541670-1	2-Critical		Memory leak and potential crash bug in secure channel cookie handling
537106-3	2-Critical		Component checks wait for page load
564040-4	3-Major		Differentiation of missing component alerts
560069-1	3-Major		Default obfuscator configuration causes very slow javascript in some browsers
558255-2	3-Major		Filtering encryption alerts
555818-3	3-Major		Bait failure alerts do not give details of the cause of failure
554546-2	3-Major		Only first entry in 'Mandatory Words' list is effective
552476-2	3-Major		Use of JavaScript's 'eval' function may be prohibited by site's content security policy
551893-2	3-Major		Alerts send from FPS plugin via HSL are sent in a malformed HTTP format
542586-3	3-Major		Fallback alert mechanism can result in page refresh in Internet Explorer 8
542581-3	3-Major		WebSafe alerts with HTML attached cause the page to run slowly
542472	3-Major		SSL::disable for alerts does not take effect and first alert fails
503160-3	3-Major		FPS malicious words doesn't trigger alert when ignore list is defined
560791	4-Minor		FPS doesn't encrypt inputs of type "hidden"
555827-2	4-Minor		No fallback for alerts.
547038-2	4-Minor		In very fast transactions, some detection data is missing

Device Management Fixes

ID Number	Severity	Solution Article(s)	Description
538722-3	3-Major	K06150134	Configurable maximum message size limit for restjavad

iApp Technology Fixes

ID Number	Severity	Solution Article(s)	Description
546082-5	2-Critical		Special characters might change input.

Cumulative fixes from BIG-IP v11.6.0 Hotfix 8 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
600662-4	CVE-2016-5745	K64743453	NAT64 vulnerability CVE-2016-5745
599168-4	CVE-2016-5700	K35520031	BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700
598983-4	CVE-2016-5700	K35520031	BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700
580596-9	CVE-2013-0169 CVE-2016-6907	K14190 K39508724	TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 / TMM SSL/TLS virtual server vulnerability CVE-2016-6907
569467-11	CVE-2016-2084	K11772107	BIG-IP and BIG-IQ cloud image vulnerability CVE-2016-2084.

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
557221-7	2-Critical		Inbound ISP link load balancing will use pool members for only one ISP link per data center

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
596603-11	2-Critical		AWS: BIG-IP VE doesn't work with c4.8xlarge instance type.
547047	2-Critical	K31076445	Older cli-tools unsupported by AWS
595874-4	3-Major		Upgrading 11.5.x/11.6.x hourly billing instances to 12.1.0 fails due to license SCD.★
556277-6	3-Major		Config Sync error after hotfix installation (chroot failed rsync error)★
499537-3	3-Major	K22406859	Qkview may store information in the wrong format

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
557645-5	3-Major		Communication between devices in a high availability (HA) configuration might occasionally fail on VIPRION 2200 and 2400 platforms.

Cumulative fixes from BIG-IP v11.6.0 Hotfix 7 that are included in this release


Functional Change Fixes

None


TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
591857	1-Blocking		10-core vCMP guest with ASM may not pass traffic

Cumulative fixes from BIG-IP v11.6.0 Hotfix 6 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
532522-3	CVE-2015-1793	K16937	CVE-2015-1793
536984	CVE-2015-8240	K06223540	Ensure min_path_mtu is functioning as designed.
536481-9	CVE-2015-8240	K06223540	F5 TCP vulnerability CVE-2015-8240
534630-5	CVE-2015-5477	K16909	Upgrade BIND to address CVE 2015-5477
530829	CVE-2015-5516	K00032124	UDP traffic sent to the host may leak memory under certain conditions.
529509-5	CVE-2015-4620	K16912	BIND Vulnerability CVE-2015-4620
527799-9	CVE-2015-4000 CVE-2015-1792 CVE-2015-1791 CVE-2015-1790 CVE-2015-1789 CVE-2015-1788 CVE-2014-8176	K16674 K16915 K16914	OpenSSL library in APM clients updated to resolve multiple vulnerabilities
527630-1	CVE-2015-1788	K16938	CVE-2015-1788 : OpenSSL Vulnerability
506034-3	CVE-2014-9297 CVE-2014-9298 CVE-2014-9750 CVE-2014-9751	K16393	NTP vulnerabilities (CVE-2014-9297,CVE-2014-9298)
540849-5	CVE-2015-5986	K17227	BIND vulnerability CVE-2015-5986
540846-5	CVE-2015-5722	K17181	BIND vulnerability CVE-2015-5722
531576-1	CVE-2016-7476	K87416818	TMM vulnerability CVE-2016-7476
520466-2	CVE-2015-3628	K16728	Ability to edit iCall scripts is removed from resource administrator role
516618-5	CVE-2013-7424	K16472	glibc vulnerability CVE-2013-7424
526514-1	CVE-2016-3687	K26738102	Open redirect via SSO_ORIG_URI parameter in multi-domain SSO
522878-1	CVE-2016-3686	K82679059	Hide the cleartext Session ID (MRHSessionCookie) visible as part of URL query param to prevent unauthorized access.
515345-1	CVE-2015-1798	K16505	NTP Vulnerability

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
502443-4	2-Critical	K16457	After enabling a blade/HA member, pool members are marked down because monitoring starts too soon.
520705-5	3-Major		Edge client contains multiple duplicate entries in server list
498992-6	3-Major		Troubleshooting enhancement: improve logging details for AWS failover failure.
471042-6	3-Major		Datastor High Velocity Traffic Pattern Changes
224903-5	3-Major	K71296207	CounterBasedGauge64 MIB values do not work with Network Management Systems. The MIB should be Gauge32.

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
544980-3	1-Blocking		BIG-IP Virtual Edition may have minimal disk space for the /var software partition when deploying from the OVA file for the Better or Best license bundle.
535806-2	1-Blocking		Not enough free disk space for live install of BIG-IP 12.0.0 from 11.5.3 VE
507312-1	1-Blocking		icrd segmentation fault
477218-5	1-Blocking		Simultaneous stats query and pool configuration change results in process exit on secondary.
473033-5	1-Blocking		Datastor Now Uses Syslog-ng
529510-2	2-Critical		Multiple Session ha state changes may cause TMM to core
523434	2-Critical	K85242410	mcpd on secondary blades will restart with an error message about a sflow_http_virtual_data_source object
513454-3	2-Critical		An snmpwalk with a large configuration can take too long, causing snmpd or mcpd restarts
510979-1	2-Critical		Password-less SSH access after tmsh load of UCS may require password after install.
509503-4	2-Critical		tmsh load sys config merge file 'filename' takes signficant time for firewall rulelist configuration
507602-1	2-Critical	K17166	Data packet over IPsec tunnel might be looping between cores after rekey if IPsec lifebyte is enabled
506199-4	2-Critical		VCMP guests on VDAG platforms can experience excessive tmm redirects after multiple guest provisioning cycles
504496-3	2-Critical		AAA Local User Database may sync across failover groups
497078-1	2-Critical		Modifying an existing ipsec policy configuration object might cause tmm to crash
479460-5	2-Critical		SessionDb may be trapped in wrong HA state during initialization
473105	2-Critical		FastL4 connections reset with pva-acceleration set to guaranteed
471860-3	2-Critical		Disabling interface keeps DISABLED state even after enabling
470813-1	2-Critical		Memory corruption in f5::rest::CRestServer::g_portToServerMap
468473-2	2-Critical	K16193	Monitors with domain username do not save/load correctly
464870-7	2-Critical	K94275315	Datastor cores and restarts.
438674-5	2-Critical	K14873	When log filters include tamd, tamd process may leak descriptors
429018-2	2-Critical	K17438	tmipsecd cores when deleting a non-existing traffic selector
420107-2	2-Critical		TMM could crash when modifying HTML profile configuration
364978-1	2-Critical		Active/standby system configured with unit 2 failover objects★
544888-5	3-Major	K17426	Idle timeout changes to five seconds when using PVA full or Assisted acceleration.
534251-1	3-Major		Live update with moving config breaks password-less ssh access
533458-4	3-Major		Insufficient data for determining cause of HSB lockup.
533257-2	3-Major		tmsh config file merge may fail when AFM security log profile is present in merged file
528881	3-Major		NAT names with spaces in them do not upgrade properly★
528310	3-Major	K17384	Upgrade failure when CertKeyChain exists in non-Common partition★
527537	3-Major		CGNAT experiences increased CPU utilization with a high concurrent connection load and persistence enabled
527145-4	3-Major	K53232218	On shutdown, SOD very infrequently cores due to an internal processing error during the shutdown.
527094-1	3-Major	K17295	iControl REST: the records collection in tm/ltm/data-group/internal/ may show wrong partition and subPath metadata.
527021-1	3-Major		BIG-IQ iApp statistics corrected for empty pool use cases
526419-1	3-Major		Deleting an iApp service may fail
524791-3	3-Major		non_blocking_send/receive do not correctly handle EINTR situation for poll() == 0
524753-1	3-Major		IPsec interface is not forwarding TCP flow to the host when the destination is tunnel self-ip
524490-4	3-Major	K17364	Excessive output for tmsh show running-config
524326-4	3-Major		Can delete last ip address on a gtm server but cannot load a config with a gtm server with no ips
523922-4	3-Major		Session entries may timeout prematurely on some TMMs
523125	3-Major	K17350	Disabling/enabling blades in cluster can result in inconsistent failover state
520640-2	3-Major	K31002924	The iControl Management.Zone.get_zone() method can return zone options in a format inconsistent for use with the Management.Zone.set_zone_option() method.
519510-3	3-Major	K17164	Throughput drop and rxbadsum stat increase in tagged VLAN with LRO/GRO on BIG-IP VE running on ESX platforms with particular network hardware
519372	3-Major	K55273152	vCMP guest memory growth due to large number of /var/run/tmstats-rsync.* files.
519068-3	3-Major		device trust setup can require restart of devmgmtd
518283	3-Major	K16524	Cookie rewrite mangles 'Set-Cookie' headers
518039-1	3-Major		BIG-IQ iApp statistics corrected for partition use cases
517580-3	3-Major	K16787	OPT-0015 on 10000-series appliance may cause bcm56xxd restarts
517178-2	3-Major	K29660332	BIG-IP system as SAML Service Provider cannot process some messages from SimpleSAMLphp under certain conditions
516669-1	3-Major	K34602919	Rarely occurring SOD core causes failover.
515667-4	3-Major		Unique truncated SNMP OIDs.
514726-4	3-Major	K17144	Server-side DSR tunnel flow never expires
514724-1	3-Major	K05364212	crypto-failsafe fail condition not cleared when crypto device restored
513916-5	3-Major	K80955340	String iStat rollup not consistent with multiple blades
513294-8	3-Major		LBH firmware v3.07 update for BIG-IP 5000-/7000-series appliances
510159-1	3-Major		Outgoing MAP tunnel statistics not updated
510119-4	3-Major		HSB performance can be suboptimal when transmitting TSO packets.
509782-3	3-Major	K16780	TSO packets can be dropped with low MTU
509504-5	3-Major	K17500	Excessive time to save/list a firewall rule-list configuration
509037-1	3-Major	K17058	BIG-IP systems allows creating wild-card IPIP tunnels with the same local-address and tunnel-type
507853-1	3-Major		MCP may crash while performing a very large chunked query and CPU is highly loaded
507575-1	3-Major		An incorrectly formated NAPTR creation via iControl can cause an error.
506041-2	3-Major	K01256304	Folders belonging to a device group can show up on devices not in the group
505045-1	3-Major	K56700956	MAP implementation not working with EA bits length set to 0.
504494-2	3-Major	K43624250	Upgrading to 11.5.0 and later might associate a disabled HA group to traffic groups.★
502238-3	3-Major	K16736	Connectivity and traffic interruption issues caused by a stuck HSB transmit ring
501437-3	3-Major		rsync daemon does not stop listening after configsync-ip set to none
500234-4	3-Major		TMM may core during failover due to invalid memory access in IPsec components
499260-3	3-Major		Deleting trust-domain fails when standby IP is in ha-order
497564-2	3-Major		Improve High Speed Bridge diagnostic logging on transmit/receive failures
497304-1	3-Major		Unable to delete reconfigured HTTP iApp when auto-sync is enabled
495526-1	3-Major		IPsec tunnel interface causes TMM core at times
493246-2	3-Major	K17414	SNMP error: Unknown Object Identifier (Index out of range:0 ) for sysCpuSensorSlot
493213-1	3-Major		RBA eam and websso daemons segfaulting while provisioning
491716-2	3-Major		SNMP attribute type incorrect for certain OIDs
491556-7	3-Major	K16573	tmsh show sys connection output is corrected
489084-1	3-Major		Validation error in MCPD for FQDN nodes
484706-2	3-Major	K16460	Incremental sync of iApp changes may fail
483104-3	3-Major	K17365	vCMP guests report platform type as 'unknown'
481648-8	3-Major		mib-2 ipAddrTable interface index does not correlate to ifTable
480679-1	3-Major	K16858	The big3d daemon does not receive config updates from mcpd
473348-6	3-Major	K16654	SNMP hbInterval value not set to 300 sec after upgrade from 11.2.x to 11.3.0 or later
473088-4	3-Major	K17091	Virtual server with RequestAdapt/ResponseAdapt profiles along with a OneConnect profile
470756-6	3-Major		snmpd cores or crashes with no logging when restarted by sod
468837-5	3-Major		SNAT translation traffic group inheritance does not sync across devices
464252-2	3-Major		Possible tmm crash when modifying html pages with HTML profile.
464024-4	3-Major	K16455	File descriptor leak when running some TMSH commands through scriptd
458104-3	3-Major	K16795	LTM UCS load merge trunk config issue
455264-3	3-Major	K54105052	Error messages are not clear when adding member to device trust fails
442871-1	3-Major	K17185	BIG-IP VE instances created using OpenStack interfaces may fail to detect the KVM hypervisor
441297-3	3-Major	K16493	Trunk remains down and interface's status is 'uninit' after mcpd restart
416388-1	3-Major		vCMPD will not reattach to guest
410398-3	3-Major		sys db tmrouted.rhifailoverdelay does not seem to work
405752-1	3-Major	K22040410	TCP Half Open monitors sourced from specific source ports can fail
383784-5	3-Major	K17289	Remote Auth user names containing blank space cannot login through TMSH.
362267-3	3-Major	K17488	Configuring network failover on a VIPRION cluster using the blade management addresses results in 'Cannot assign requested address' errors★
359774-6	3-Major		Pools in HA groups other than Common★
355661-3	3-Major	K85476133	sod logs error 010c003b:3: bind fails on recv_sock_fd, Cannot assign requested address
524606-1	4-Minor		SElinux violations prevent cpcfg from touching /service/mcpd/forceload
524185	4-Minor		Unable to run lvreduce
523863-2	4-Minor		istats help not clear for negative increment
492163-3	4-Minor	K12400	Applying a monitor to pool and pool member may cause an issue.
475647-2	4-Minor		VIPRION Host PIC firmware version 7.02 update
473163-2	4-Minor		RAID disk failure and alert.conf log message mismatch results in no trap
471827-1	4-Minor		Firstboot early syslog-ng log: /var/run/httpd.pipe does not exist★
465675-3	4-Minor	K07816405	Invalid MAX-ACCESS clause for deprecated variables: ltmNodeAddrNewSessionEnable and ltmPoolMemberNewSessionEnable.
465317-1	4-Minor	K10890804	Failure notice from '/usr/bin/set-rsync-mgmt-fw close' seen on each boot.
464043-3	4-Minor		Integration of Firmware for the 2000 Series Blades
443298-2	4-Minor		FW Release: Incorporate VIPRION 2250 LOP firmware v1.20
356658-2	5-Cosmetic	K28234602	Message logged when remote authenticated users do not have local account login

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
522784-2	1-Blocking		After restart, system remains in the INOPERATIVE state
420341-6	1-Blocking	K17082	Connection Rate Limit Mode when limit is exceeded by one client also throttles others
552937-1	2-Critical		HTTP::respond or HTTP::redirect in a non-HTTP iRule event can cause the next pipelined request to fail.
539344-1	2-Critical		SPDY child flow aborted while stalled leaves freed SPDY stream in SPDY stalled list
538255	2-Critical		SSL handshakes on 4200/2200 can cause TMM cores.
533388-1	2-Critical		tmm crash with assert "resume on different script"
530963-4	2-Critical		BIG-IP TLS doesn't correctly verify Finished.verify_data on non-Cavium platforms
528432-2	2-Critical		Control plane CPU usage reported too high
523079-2	2-Critical		Merged may crash when file descriptors exhausted
514108-1	2-Critical		TSO packet initialization failure due to out-of-memory condition.
510837-2	2-Critical		Server initiated renegotiation fails with dhe_dss/ecdhe_ecdsa and ecdh_ecdsa ciphers. BIG-IP sends bad client key exchange.
509346-2	2-Critical	K01051264	Intermittent or complete SSL handshake failure with netHSM keys
506304-2	2-Critical		UDP connections may stall if initialization fails
505331-1	2-Critical	K17092	SASP Monitor may core
505222-2	2-Critical		DTLS drops egress packets when traffic is large
503343-7	2-Critical		TMM crashes when cloned packet incorrectly marked for TSO
499422-1	2-Critical	K31310380	An optimistic ACK sent by a server in response to a BIG-IP FIN/ACK packet result in a FIN/ACK storm.
497299-5	2-Critical		Thales install fails if the BIG-IP system is also configured as the RFS
492352-3	2-Critical		SSL profiles using password protected SSL keys cause config utility error
481677-2	2-Critical		A possible TMM crash in some circumstances.
481162-2	2-Critical	K16458	vs-index is set differently on each blade in a chassis
474601-5	2-Critical		FTP connections are being offloaded to ePVA
450814-10	2-Critical		Early HTTP response might cause rare 'server drained' assertion
431283-7	2-Critical		iRule binary scan may core TMM when the offset is large
426328-8	2-Critical	K14654	Updating iRule procs while in use can cause a core
402412-8	2-Critical		FastL4 tcp handshake timeout is not honored, connection lives for idle timeout.
551612	3-Major		BIG-IP SSL does not support sending multiple certificate verification requests to the hardware accelerator at the same time in 11.6.0.
530431	3-Major	K17537	FQDN nodes: ephemeral nodes not being created for resolved FQDN hosts★
526810-5	3-Major		Crypto accelerator queue timeout is now adjustable
525557	3-Major		FQDN ephemeral nodes not re-populated after deleted and re-created
524666-3	3-Major		DNS licensed rate limits might be unintentionally activated.
522147-2	3-Major		'tmsh load sys config' fails after key conversion to FIPS using web GUI
521774-3	3-Major	K17420	Traceroute and ICMP errors may be blocked by AFM policy
521538-2	3-Major	K08025400	Keep-alive transmissions do not resume after failover of flows on an L4 virtual, when the sequence number is known
521522-3	3-Major	K21981142	Traceroute through BIG-IP may display destination IP address at BIG-IP hop
521408-3	3-Major		Incorrect configuration in BigTCP Virtual servers can lead to TMM core
520540-1	3-Major		Specific iRule commands may generate a core file
518020-11	3-Major	K16672	Improved handling of certain HTTP types.
517790-1	3-Major		When non-HTTP traffic causes the server-side to receive unexpected data, the connection will be dropped
517556-3	3-Major		DNSSEC unsigned referral response is improperly formatted
516598-1	3-Major	K82721850	Multiple TCP keepalive timers for same Fast L4 flow
516320-2	3-Major		TMM may have a CPU spike if match cross persist is used.
515817-2	3-Major		TMM may not reset connection when receiving an ICMP error
515322-1	3-Major		Intermittent TMM core when using DNS cache with forward zones
515072-4	3-Major	K17101	Virtual servers with priority groups reset incoming connections when a non-zero connection limit is increased
514246-3	3-Major		connflow_precise_check_begin does not check for NULL
512383-3	3-Major	K68275911	Hardware flow stats are not consistently cleared during fastl4 flow teardown.
512148-1	3-Major	K17154	Self IP address cannot be deleted when its VLAN is associated with static route
512062-2	3-Major	K21528300	A db variable to disable verification of SCTP checksum when ingress packet checksum is zero
510921-1	3-Major	K23548911	Database monitors do not support IPv6 nodes
510720-1	3-Major	K81614705	iRule table command resumption can clear the header buffer before the HTTP command completes
510638-1	3-Major	K37513511	[DNS] Config change in dns cache resolver does not take effect until tmm restart
507529-1	3-Major		Active crash with assert: tmm failed assertion, non-zero ha_unit required for mirrored flow
506282-1	3-Major	K16168	GTM DNSSEC keys generation is not sychronized upon key creation
505059-1	3-Major		Some special characters are not properly handled for username and password fields in TCL monitors
504899-2	3-Major		Duplicated snat-translation addresses are possible (a named and an anonymous (created by snatpool) one)
504306-2	3-Major		https monitors might fail to re-use SSL sessions.
504105-4	3-Major		RR-DAG enabled UDP ports may be used as source ports for locally originated traffic
503979-1	3-Major		High CPU usage when DNS cache resolver sends a large number of DNS queries to the backend name server.
503384-1	3-Major	K17394	SMTP monitor fails on multi line greeting banner in SMTP server
501516-5	3-Major		If a very large number of monitors is configured, bigd can run out of file descriptors when it is restarted.
497742-3	3-Major		Some TCP re-transmits on translucent vlangroup skip bit-flip on source MAC address
496758-5	3-Major	K16465	Monitor Parameters saved to config in a certain order may not construct parameters correctly
495836-2	3-Major		SSL verification error occurs when using server side certificate.
495557-1	3-Major		Ephemeral node health status may report as 'unknown' rather than the expected 'offline'
490713-3	3-Major		FTP port might occasionally be reused faster than expected
490429-2	3-Major	K17206	The dynamic routes for the default route might be flushed during operations on non-default route domains.
488600-2	3-Major		iRule compilation fails on upgrade★
488581	3-Major	K17539	The TMM process may restart and produce a core file when using the SSL::disable clientside iRule command within a HTTP_REQUEST event
485472-3	3-Major		iRule virtual command allows for protocol mismatch, resulting in crash
479674-1	3-Major	K16629	bigd crash on improper monitor configuration (timeout less than the interval) for Tcl monitors.
478617-6	3-Major	K16451	Don't include maximum TCP options length in calculating MSS on ICMP PMTU.
478439-6	3-Major	K16651	Unnecessary re-transmission of packets on higher ICMP PMTU.
478257-7	3-Major		Unnecessary re-transmission of packets on ICMP notifications even when MTU is not changed
476097-1	3-Major	K15274113	TCP Server MSS option is ignored in verified accept mode
474356-1	3-Major		Client SSL on partition other than /Common does not load if no key/cert/inherit-certkeychain
471059-4	3-Major		Malformed cookies can break persistence
465607-7	3-Major	K15966	TMM cores with TMM log error 'Assertion "flow in use" failed.' when isuing FastHTTP.
465590-9	3-Major	K17531	Mirrored persistence information is not retained while flows are active
465052-6	3-Major	K16060	Some HTTP::cookie iRule commands can cause TMM to core if required arguments are missing
462714-2	3-Major	K66236389	Source address persistence record times out even while traffic is flowing on FastL4 profile virtual server
460627-3	3-Major	K17059	SASP monitor starts a new connection to the Group Workload Manager (GWM) server when a connection to it already exists
447874-5	3-Major		TCP zero window suspends data transfer
447043-3	3-Major	K17095	Cannot have 2 distinct 'contains' conditions on the same LTM policy operand
422107-8	3-Major	K17415	Responses from DNS transparent cache will no longer contain RRSIG for queries without DO bit set
422087-5	3-Major	K16326	Low memory condition caused by Ram Cache may result in TMM core
375887-4	3-Major	K17282	Cluster member disable or reboot can leak a few cross blade trunk packets
374339-4	3-Major		HTTP::respond/redirect might crash TMM under low-memory conditions
364994-7	3-Major	K16456	TMM may restart or disabled connections may be reused when a OneConnect profile is configured and OneConnect reuse is disabled be an iRule.
352925-2	3-Major	K16288	Updating a suspended iRule and TMM process restart
348000-1	3-Major		HTTP response status 408 request timeout results in error being logged.
342013-6	3-Major	K27445955	TCP filter doesn't send keepalives in FIN_WAIT_2
226892-13	3-Major	K12831	Packet filter enabled, default action discard/reject and IP fragment drop
486485-1	4-Minor		TCP MSS is incorrect after ICMP PMTU message.
454692-4	4-Minor	K16235	Assigning 'after' object to a variable causes memory leaks
442647-5	5-Cosmetic	K04311130	IP::stats iRule command reports incorrect information past 2**31 bits

Global Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
515797-1	2-Critical		Using qos_score command in RULE_INIT event causes TMM crash
513464-1	2-Critical		Some autodiscovered virtuals may be removed from pools.
471819-2	2-Critical		The big3d agent restarts periodically when upgrading the agent on a v11.4.0 or prior system and Common Criteria mode is enabled.
517083-1	3-Major		Some autodiscovered virtuals may be removed from pools.
516685-2	3-Major		ZoneRunner might fail to load valid zone files.
516680-2	3-Major		ZoneRunner might fail when loading valid zone files.
515033	3-Major		[ZRD] A memory leak in zrd
515030-1	3-Major	K74820030	[ZRD] A memory leak in Zrd
496775-3	3-Major	K16194	[GTM] [big3d] Unable to receive mark LTM virtual server up if there is another VS with same ltm_name for the bigip monitor
479142-1	3-Major	K16173	Deleting a virtual server does not delete the resource record (RR) in ZoneRunner Daemon (ZRD)
465951-2	3-Major	K12562945	If net self description size =65K, gtmd restarts continuously
479084-1	4-Minor		ZoneRunner can fail to respond to commands after a VE resume.
353556-4	4-Minor		big3d https monitor is unable to correctly monitor the web server when SSL protocol is changed

Application Security Manager Fixes

ID Number	Severity	Solution Article(s)	Description
524428-1	2-Critical		Adding multiple signature sets concurrently via REST
524004-1	2-Critical		Adding multiple signatures concurrently via REST
520280-1	2-Critical		Perl Core After Apply Policy Action
513822-1	2-Critical		ASM REST: Expected Content Value Is Not Set When Setting The responseActionType For A Response Page
511196-1	2-Critical		UMU memory is not released when remote logger can't reach its detination
532030-3	3-Major		ASM REST: Custom Signature Set Created via REST is Different Than When Created From GUI
531539-1	3-Major	K05113177	The NTLM login is not recognized as failed login.
527861	3-Major		When Many entities are displayed on the "Illegal Meta Character in Value" manual traffic learning screen, the Configuration utility becomes unresponsive.
526856-1	3-Major		"Use of uninitialized value" warning appears on UCS installation due to ASM signature inconsistency
523261-1	3-Major		ASM REST: MCP Persistence is not triggered via REST actions
523260-1	3-Major	K52028045	Apply Policy finishes with coapi_query failure displayed
523201-2	3-Major		Expired files are not cleaned up after receiving an ASM Manual Synchronization
520585-2	3-Major		Changing Security Policy Application Language Is Not Validated or Propagated Properly
519053-1	3-Major		Request is forwarded truncated to the server after answering challenge on a big request
516522-1	3-Major	K04420402	After upgrade from any pre-11.4.x to 11.4.x through 12.0.0, the configured redirect URL location is empty.★
486829-1	3-Major	K17512	HTTP Protocol Compliance options should not be modified during import/upgrade★
467930-1	3-Major	K47335122	Searching ASM Request Log for requests with specific violations
514117-1	4-Minor		Store source port higher than 32767 in Request Log record

Application Visibility and Reporting Fixes

ID Number	Severity	Solution Article(s)	Description
531526-2	3-Major	K17560	Missing entry in SQL table leads to misleading ASM reports
530356-2	3-Major		Some AVR tables that hold ASM statistics are not being backed up in upgrade process.
526277-1	3-Major		AFM attack may never end on AVR dos overview page in a chassis based BIG-IP
525708-1	3-Major	K17555	AVR reports of last year are missing the last month data
519022-2	3-Major	K01334306	Upgrade process fails to convert ASM predefined scheduled-reports.★
518663-1	3-Major		Client waits seconds before page finishes load
499315-1	3-Major		Added "Collect full URL" functionality.
485251-1	3-Major		AVR core witch include tmstat backtrace
479334-5	3-Major	K16894	monpd/ltm log errors after Hotfix is applied
472117-2	3-Major		Analytics scheduled report: "predefinedReportName" and "multiLeveledReport" are mutually exclusive

Access Policy Manager Fixes

ID Number	Severity	Solution Article(s)	Description
492149-3	1-Blocking		Inline JavaScript with HTML entities may be handled incorrectly
488736-5	1-Blocking		Fixed problem with iNotes 9 Instant Messaging
482266-3	1-Blocking		Windows 10 support for Network Access / BIG-IP Edge Client
482241-1	1-Blocking		Windows 10 cannot be properly detected
439880-2	1-Blocking		NTLM authentication does not work due to incorrect NetBIOS name
405769-3	1-Blocking		APM Logout page is not protected against CSRF attack.
532340-1	2-Critical		When FormBased SSO or SAML SSO are configured, tmm may restart at startup
526754-2	2-Critical		F5unistaller.exe crashes during uninstall
525562-1	2-Critical		Debug TMM Crashes During Initialization
523313-1	2-Critical	K17574	aced daemon might crash on exit
520298-2	2-Critical		Java applet does not work
520145-3	2-Critical		[Policy Sync] OutOfMemoryError exception when syncing big and complex APM policy
519864-3	2-Critical		Memory leak on L7 Dynamic ACL
518260-1	2-Critical		Missing NTLMSSP_TARGET_INFO flag on NTLMSSP_CHALLENGE message
517988-2	2-Critical		TMM may crash if access profile is updated while connections are active
514220-1	2-Critical		New iOS-based VPN client may fail to create IPv6 VPN tunnels
509490-2	2-Critical		[IE10]: attachEvent does not work
507681-5	2-Critical		Window.postMessage() does not send objects in IE11
506223-2	2-Critical		A URI in request to cab-archive in iNotes is rewritten incorrectly
502269-1	2-Critical		Large post requests may fail using form based SSO.
493993-6	2-Critical	K15914	TMM crashes on the standby when starting up in HA config and Active processing traffic in APM module
492287-1	2-Critical		Support Android RDP client 8.1.3 with APM remote desktop gateway
480272-6	2-Critical	K17117	During OAM SDK initialization, ObConfig initialization returns wrong accessgate ID
540778-3	3-Major		Multiple SIGSEGV with core and failover with no logged indicator
539013-6	3-Major		DNS resolution does not work on a Windows 10 desktop with multiple NICs after VPN connection has been established in some cases
537614-1	3-Major		Machine certificate checker fails to use Machine cert check service if Windows has certain display languages
537000-2	3-Major		Installation of Edge Client can cause Windows 10 crash in some cases
534755-1	3-Major		Deleting APM virtual server produces ERR_NOT_FOUND error
533566-1	3-Major		Support for View HTML5 client v3.5 shipped with VCS 6.2
532761	3-Major		APM fails to handle compressed ICA file in integration mode
532096-2	3-Major		Machine Certificate Checker is not backward compatible with 11.4.1 (and below) when MatchFQDN rule is used
531910-1	3-Major		apmd, apd, localmgr random crash
531883-2	3-Major		Windows 10 App Store VPN Client must be detected by BIG-IP APM
531541-1	3-Major		Support Citrix Receiver 4.3 for Windows in PNAgent mode
531529-1	3-Major		Support for StoreFront proxy
531483-2	3-Major		Copy profile might end up with error
530800-1	3-Major		Messages can't be sent from OWA2010 via Portal Access if form-based SSOv2 is in use.
530773	3-Major		per-request policy logs frequently in apm logs
530697-2	3-Major		Windows Phone 10 platform detection
529392-2	3-Major		Win10 and IE11 is not determined in case of DIRECT rule of proxy autoconfig script
528768-1	3-Major		Relaxing validation against "_" character for ActiveDirectory server FQDN for NTLM authentication
528727-1	3-Major		In some cases HTML body.onload event handler is not executed via portal access.
528726-3	3-Major		AD/LDAP cache size reduced
528675-2	3-Major		BIG-IP EDGE Client can indefinitely stay "disconnecting..." state when captive portal session expired
526677-1	3-Major		VMware Horizon HTML5 View access client can not connect when using View Connection Server running version 6.1.1
526617-1	3-Major		TMM crash when logging a matched ACL entry with IP protocol set to 255
526578-1	3-Major		Network Access client proxy settings are not applied on German Windows
526492-2	3-Major		DNS resolution fails for Static and Optimized Tunnels on Windows 10
526275-1	3-Major		VMware View RSA/RADIUS two factor authentication fails
526084-3	3-Major		Windows 10 platform detection for BIG-IP EDGE Client
525384-2	3-Major		Networks Access PAC file now can be located on SMB share
524909-2	3-Major		Windows info agent could not be passed from Windows 10
523431-2	3-Major		Windows Cache and Session Control cannot support a period in the access profile name
523390-2	3-Major		Minor memory leak on IdP when SLO is configured on bound SP connectors.
523327-2	3-Major		In very rare cases Machine Certificate service may fail to find private key
523305-1	3-Major		Authentication fails with StoreFront protocol
523222-6	3-Major		Citrix HTML5 client fails to start from Storefront in integration mode when Access Policy is configured with Redirect ending.
521835-2	3-Major		[Policy Sync] Connectivity profile with a customized logo fails
521773-2	3-Major	K10105099	Memory leak in Portal Access
521506-2	3-Major		Network Access doesn't restore loopback route on multi-homed machine
520642-3	3-Major		Rewrite plugin should check length of Flash files and tags
520390-1	3-Major		Reuse existing option is ignored for smtp servers
520205-3	3-Major		Rewrite plugin could crash on malformed ActionScript 3 block in Flash file
520118-2	3-Major		Duplicate server entries in Server List.
519966-2	3-Major		APM "Session Variables" report shows user passwords in plain text
519415-3	3-Major		apm network access tunnel ephemeral listeners ignore irules (related-rules from main virtual )
519198-3	3-Major		[Policy Sync] UI General Exception Error when sync a policy in non-default partition as non-default admin user
518981-2	3-Major		RADIUS accounting STOP message may not include long class attributes
518583-2	3-Major		Network Access on disconnect restores redundant default route after looped network roaming for Windows clients
518573	3-Major		The -decode option should be added to expressions in AD and LDAP group mapping.
518432	3-Major		[Mac][Linux][NA] TLS tunnel freezes on Mac and Linux in case of SSL renegotiation
517564-1	3-Major		APM cannot get groups from an LDAP server, when LDAP server is configured to use non-default port
517441-5	3-Major		apd may crash when RADIUS accounting message is greater than 2K
516839-3	3-Major		Add client type detection for Microsoft Edge browser
516462-2	3-Major		Gateways for excluded address space routes are not adjusted correctly during roaming between networks on Windows machines
515943-2	3-Major		"Session variables" report may show empty if session variable value contains non-English characters
514912-3	3-Major		Portal Access scripts had not been inserted into HTML page in some cases
513969-3	3-Major		UAC prompt is shown for machine cert check for non-limited users, even if machine cert check service is running
513953-1	3-Major	K17122	RADIUS Auth/Acct might fail if server response size is more than 2K
513706-2	3-Major	K16958	Incorrect metric restoration on Network Access on disconnect (Windows)
513545-1	3-Major		'-decode' option produce incorrect value when it decodes a single value
513283-1	3-Major		Mac Edge Client doesnt send client data if access policy expired
513098-1	3-Major	K17180	localdb_mysql_restore.sh failed with exit code
512345-2	3-Major	K17380	Dynamic user record removed from memcache but remains in MySQL
512245-7	3-Major		Machine certificate agent on OS X 10.8 and OS X 10.9 uses local host name instead of hostname
511854-4	3-Major	K85408112	Rewriting URLs at client side does not rewrite multi-line URLs
510709-1	3-Major		Websso start URI match fails if there are more than 2 start URI's in SSO configuration.
509722-1	3-Major		BWC traffic blocked
509677-1	3-Major		Edge-client crashes after switching to network with Captive Portal auth
504031-1	3-Major		document.write()/document.writeln() redefinition does not work
501494-1	3-Major		if window.onload is assigned null, then null should be retrieved
500938-3	3-Major		Network Access can be interrupted if second NIC is disconnected
500450-1	3-Major		ASM and APM on same virtual server caused Set-Cookie header modification done by ASM not honored by APM websso.
495336-1	3-Major	K39768154	Logon page is not displayed correctly when 'force password change' is on for local users.
494637-2	3-Major	K80550446	localdbmgr process in constant restart/core loop
494565-4	3-Major	K65181614	CSS patcher crashes when a quoted value consists of spaces only
493023-3	3-Major		Export of huge policies might ends up with 'too many pipes opened' error
492701-3	3-Major		Resolved LSOs are overwritten by source device in new Policy Sync with new LSO
492305-1	3-Major		Recurring file checker doesn't interrupt session if client machine has missing file
490830-4	3-Major		Protected Workspace is not supported on Windows 10
488105-3	3-Major		TMM may generate core during certain config change.
483792-5	3-Major		when iSession control channel is disabled, don't assign app tunnel, MSRDP, opt tunnel resources
483501-1	3-Major		Access policy v2 memory leak during object deletion in tmm.
483286-3	3-Major		APM MySQL database full as log_session_details table keeps growing
483020-1	3-Major	K17533	[SWG] Policy execution hang when using iRule event in VPE
482699-4	3-Major		VPE displaying "Uncaught TypeError"
482251-3	3-Major	K95824957	Portal Access. Location.href(url) support.
481987-6	3-Major		Allow NTLM feature to be enabled with APM Limited license
481663-5	3-Major		Disable isession control channel on demand.
480761-1	3-Major		Fixed issue causing TunnelServer to crash during reconnect
478751-6	3-Major	K35826411	OAM10g form based AuthN is not working for a single/multiple domain.
478492-7	3-Major	K17476	Incorrect handling of HTML entities in attribute values
475735-4	3-Major	K30145457	Failed to load config after removing peer from sync-only group
475403-2	3-Major		Tunnel reconnect with v2.02 does not occur
474779-1	3-Major		EAM process fails to register channel threads (MPI channel) with TMM, and subsequent system call fails.
473488-6	3-Major	K17376	In AD Query agent, resolving of nested groups may cause apd to spin
473255-3	3-Major	K41869058	Javascript sibmit() method could be rewritten incorrectly inside of 'with' statement.
472256-3	3-Major	K17259	tmsh and tmctl report unusually high counter values
472062-3	3-Major	K17480	Unmangled requests when form.submit with arguments is called in the page
471117-4	3-Major	K17546	iframe with JavaScript in 'src' attribute not handled correctly in IE11
468137-6	3-Major		Network Access logs missing session ID
466745-3	3-Major		Cannot set the value of a session variable with a leading hyphen.
462514-1	3-Major	K91196715	Support for XMLHttpRequest is extended
461189-5	3-Major	K16563	Generated assertion contains HEX-encoded attributes
458450-2	3-Major	K16941	The ECA process may produce a core file when processing HTTP headers
457760-5	3-Major		EAM not redirecting stdout/stderr from standard libraries to /var/log/apm
452010-3	3-Major	K16609	RADIUS Authentication fails when username or password contain non-ASCII characters
446860-4	3-Major		APM Exchange Proxy does not honor tmm.access.maxrequestbodysize DB variable and is subject to ID 405348
442698-10	3-Major		APD Active Directory module memory leak in exception
431467-1	3-Major		Mac OS X support for nslookup and dig utilities to use VPN DNS
426209-2	3-Major		exporting to a CSV file may fail and the Admin UI is inaccessible
423282-8	3-Major	K17116	BIG-IP JavaScript includes can be improperly injected in case of conditional commment presence
408851-7	3-Major		Some Java applications do not work through BIG-IP server
402793-12	3-Major		APM Network Accces tunnel slows down and loses data in secure renegotiation on Linux and Mac clients
340406-10	3-Major		Localization of BIG-IP Edge Client for Macintosh
533723-4	4-Minor		[Portal Access] Client side HTML rewriter should not rewrite content within "textarea" tag.
524756	4-Minor		APM Log is filled with errors about failing to add/delete session entry
523158-2	4-Minor		In vpe if the LDAP server returns "cn=" (lower case) dn/group match fails
517872-1	4-Minor		Include proxy hostname in logs in case of name resolution failure
513201-6	4-Minor		Edge client is missing localization of some English text in Japanese locale
510459-1	4-Minor		In some cases Access does not redirect client requests
507321-3	4-Minor		JavaScript error if user-defined object contains NULL values in 'origin' and/or 'data' fields
497627-3	4-Minor	K58125050	Tmm cores while using APM network access and no leasepool is created on the BIG-IP system.
486661-3	4-Minor		Network Access should provide client IP address on reconnect log records
482145-3	4-Minor		Text in buttons not centered correctly for higher DPI settings
478658-6	4-Minor		Window.postMessage() does not send objects
478261-2	4-Minor		WinInet handle leak in Edge Client on Windows
473685-1	4-Minor		Websso truncates cookie domain value

WebAccelerator Fixes

ID Number	Severity	Solution Article(s)	Description
522231-3	3-Major		TMM may crash when a client resets a connection
521455-2	3-Major	K16963	Images transcoded to WebP format delivered to Edge browser

Wan Optimization Manager Fixes

ID Number	Severity	Solution Article(s)	Description
497389-1	3-Major		Extraneous dedup_admin core
485182-2	3-Major	K19303084	wom_verify_config does not recognize iSession profile in /Common sub-partition
480910	3-Major		A TCP profile with 'Rate Pace" or 'Tail Loss Probe' enabled fails to successfully establish a connection.
442884-1	3-Major		TMM assert "spdy pcb initialized" in spdy_process()

Service Provider Fixes

ID Number	Severity	Solution Article(s)	Description
521556-1	2-Critical		Assertion "valid pcb" in TCP4 with ICAP adaptation
516057-3	2-Critical	K17440	Assertion 'valid proxy' can occur after a configuration change with active IVS flows.
503652-4	2-Critical	K17162	Some SIP UDP connections are lost immediately after enabling a blade on the Active HA unit.
480311-1	3-Major	K47143123	ADAPT should be able to work with OneConnect
489957-5	4-Minor		RADIUS::avp command fails when AVP contains multiple attribute (VSA).
478920	4-Minor		SIP::discard is not invoked for all request messages

Advanced Firewall Manager Fixes

ID Number	Severity	Solution Article(s)	Description
524748-1	2-Critical		PCCD optimization for IP address range
506286-1	2-Critical		TMSH reset of DOS stats
534886-1	3-Major		AFM Security checks were not being done for DNS over TCP
532022-1	3-Major		tmm can crash when the reply pkt to a service flow request is a DoS pkt
531761-1	3-Major		Web navigation flow may be reset when main page responds with non-HTML content
530865-2	3-Major		AFM Logging regression for Global/Route Domain Rules incorrectly using virtual server logging profile (if it exists)
526774	3-Major		Search in FW policy disconnects GUI users
525522	3-Major		Redirect loop when Proactive Bot Defense is enabled and deployment has multiple domains
523465-2	3-Major		Log an error message when firewall rule serialization fails due to maximum blob limit being hit.
521763-1	3-Major		Attack stopped and start messages should not have source/dst ip addresses in log messages
515112-1	3-Major		Delayed ehash initialization causes crash when memory is fragmented.
510224-2	3-Major		All descriptions for address-list members are flushed after the address-list was updated
509934-1	3-Major		Blob activation fails due to counter revision
509919-2	3-Major		Incorrect counter for SelfIP traffic on cluster
509600-1	3-Major		Global rule association to policy is lost after loading config.
481706-2	3-Major		AFM DoS Sweep Vector could log attack detected msgs from a non-attacking src IP
533808-1	4-Minor		Unable to create new rule for virtual server if order is set to "before"/"after"
533336-2	4-Minor		Display 'description' for port list members
528499	4-Minor		AFM address lists are not sorted while trying to create a new rule.
510226-2	4-Minor		All descriptions for ports-list's members are flushed after the port-list was updated
491165-1	4-Minor		Legal IP addresses sometimes logged in Attack Started/Stopped message.
495432-2	5-Cosmetic		Add new log messages for AFM rule blob load/activation in datapath.

Policy Enforcement Manager Fixes

ID Number	Severity	Solution Article(s)	Description
545558-1	1-Blocking		Send RAA when RAR is sent by PCRF and session is deleted immediately after its created.
533929	1-Blocking		PEM::subscriber info irule command can cause tmm core
525175-1	1-Blocking		Fix a crash issue when querying SSP with multi-ip.
524780-1	1-Blocking		TMM crash when quering the session information
522933-1	1-Blocking		diam_app_process_async_lookup may cause TMM crash
534490	2-Critical		Fixed TMM crash when iRule configuration is modified.
534018-1	2-Critical		Memory leak while running some of PEM::session and PEM::subscriber commands.
533734-1	2-Critical	K82536069	DHCPv6 packets arriving via tunnel are not forwarded to backend server on VIPRION
533203	2-Critical	K98322810	TMM may core on resuming iRule if the underlying flow has been deleted.
528715-1	2-Critical		rare tmm crash when ipother irule parks
527016-1	2-Critical		CLASSIFICATION_DETECTED irule event results in tmm core
524374-1	2-Critical		TMM may crash if PEM report format script with iRule are executed on top of existing parked iRule
523296-1	2-Critical		TMM may core when using iRule custom actions in PEM policies
519506-1	2-Critical		Flows dropped with initiate data from sever on virtual servers with HTTP
491771-2	2-Critical		Parking command called from inside catch statement
541592-1	3-Major		PEM : Diameter virtual reconfiguration might stop CCR-I/U/T going out for subscriber sessions
537034	3-Major	K13145204	PEM: CPU spike seen when iRule tries to update nonexistent sessions.
534323-1	3-Major		Session will be replaced rather than re-created when we update a new IP addr along with the existing IP addr.
533513-1	3-Major		Data plane Listener summary does not show LSN translation correctly
529414-1	3-Major		PEM: After Diameter Fatal-Grace time expiry, Some subscriber sessions might be deleted very soon
528787-1	3-Major		PEM: RAR after session being deleted from Radius/TMSH when connection down will return RAA with success code.
528247-1	3-Major		PEM: New Requested units empty for when used units matches granted service units
528238-1	3-Major		Quota Policy Added multiple times will lead to reset of Subscriber flows
527725-1	3-Major		BIG-IP crash caused by PSC::ip_address iRule is fixed
527292-1	3-Major		BIG-IP crash caused by PSC::user_name iRule is fixed
527289-1	3-Major		TMM crashes with core when PSC::ip_address iRule is used to list IPs
527076-1	3-Major		TMM crashes with core when PSC::policy iRule is used to set more than 32 policies
526786-1	3-Major		Session lookup fails
526368-1	3-Major		The number of IPv4 addresses per Gx session exceeds the limit of 1
526295-3	3-Major		BIG-IP crashes in debug mode when using PEM iRule to create session with calling-station-id and called-station-id
525860-2	3-Major		PEM: Duplicate sessions formed with same IP
525633-1	3-Major	K02093894	Configurable behavior if PCRF returns unknown session ID in middle of session.
525416-1	3-Major		List of IPs in "tmsh show pem sessiondb subscriber-id " may be reversed.
524409-1	3-Major		Fix TMSH show and reset-stats commands for multi-ip sessions defect.
524198-1	3-Major		PEM: Invalid HSL log generated when when session with static subscriber deleted.
522934	3-Major		Provide and option to encode subscription ID in CCR-U/CCR-T messages over Gx/Gy
522579-1	3-Major		TMM memory leak when RAR messages received from PCRF to delete for a non-existing sessions in PEM
522141-1	3-Major		Tmm cores while changing properties of PEM policies and rules.
522140-1	3-Major		Multiple IP is not added through iRule after setting the state of a session to provision by iRule
521683-1	3-Major		PEM: Session is not replaced by third and subsequent RADIUS start messages containing specific multiple IPs
521655-2	3-Major		Session hangs when trying to switch state to provisioned
504627-1	3-Major		Valid RADIUS sessions deleted on no session inactivity if no subscriber traffic exists during session timeout period.
499778-1	3-Major		A static subscriber's session is not deleted if master-IP is deleted from the subscriber's list of IPs
471926-1	3-Major		Static subscriber sessions lost after bigstart restart
539677-1	4-Minor		The file /etc/wr_urldbd/bcsdk.cfg needs to be included in the .ucs file

Carrier-Grade NAT Fixes

ID Number	Severity	Solution Article(s)	Description
533562-1	2-Critical	K15320373	Memory leak in CGNAT can result in crash
515646-1	2-Critical	K17339	TMM core when multiple PPTP calls from the same client
509108-1	2-Critical		CGNAT PBA may log port-block allocation and port-block release log messages for a port-block which is already allocated to a different subscriber
494743-1	2-Critical	K17389	Port exhaustion errors on VIPRION 4800 when using CGNAT
494122-2	2-Critical	K02533962	Deterministic NAT state information from HSL is not usable on VIPRION B4300 blades
490893-4	2-Critical	K16762	Determinstic NAT State information incomplete for HSL log format
505097-1	3-Major		lsn-pool backup-member not propagated to route table after tmrouted restart
504021-1	3-Major		lsn-pool member routes not properly propagated to routing table when lsn-pool routing-advertisement is enabled
500424-2	3-Major		dnatutil exits when reverse mapping one of the snippet results in "No tmms on the blade" error
486762-1	3-Major	K05172346	lsn-pool connection limits may be invalid when mirroring is enabled
480119-2	3-Major	K16112	Vague error - Error ERR_BOUNDS connflow ... processing pullup of control message.
455020-1	3-Major		RTSP profile idle timeout is not applied if it is longer than the TCP profile timeout

Fraud Protection Services Fixes

ID Number	Severity	Solution Article(s)	Description
526124	2-Critical		Parameter matching inconsistency
520090-1	2-Critical	K17546	Flows are closed as expired rather than closed gracefully.
529573	3-Major		CSS attribute name
527075	3-Major		Update domain availability default settings
525283-1	3-Major		Add obfuscator tuning tools
524032-1	3-Major		Control sending alerts during the source integrity learning process
513860-1	3-Major		Incomplete support for special characters in input field names
503461-1	3-Major	K88491629	Intermittent JavaScript failure on Safari on Macintosh computer or device.
529587	4-Minor		Errornous JS injections

Global Traffic Manager (DNS) Fixes

ID Number	Severity	Solution Article(s)	Description
514236-1	3-Major		[GUI][GTM] GUI does not prefix partition to device-name for BIG-IP DNS Server IP addresses

Device Management Fixes

ID Number	Severity	Solution Article(s)	Description
525595	1-Blocking	K38134424	Memory leak of inbound sockets in restjavad.
509273	2-Critical		hostagentd consumes memory over time
533307	3-Major		Increasing memory usage due to continual creation of authentication tokens
521272	3-Major	K16751	Fixed memory leak in restjavad's Authentication Token worker

iApp Technology Fixes

ID Number	Severity	Solution Article(s)	Description
495525-1	4-Minor		iApps fail when using FQDN nodes in pools

Cumulative fixes from BIG-IP v11.6.0 Hotfix 5 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
523032-6	CVE-2015-3456	K16620	qemu-kvm VENOM vulnerability CVE-2015-3456
513034-1	CVE-2015-4638	K17155	TMM may crash if Fast L4 virtual server has fragmented packets
511651-3	CVE-2015-5058	K17047	CVE-2015-5058: Performance improvement in packet processing.
477281-4	CVE-2014-6032	K15605	Improved XML Parsing
477278-5	CVE-2014-6032	K15605	XML Entity Injection vulnerabilities CVE-2014-6032 and CVE-2014-6033
476157-3	CVE-2014-4341 CVE-2014-4342	K15547	MIT Kerberos 5 vulnerability CVE-2014-4342
507842-2	CVE-2015-1349	K16356	Patch for BIND Vulnerability CVE-2015-1349
513382-13	CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0293 CVE-2015-0209 CVE-2015-0288	K16317	Resolution of multiple OpenSSL vulnerabilities
485917-3	CVE-2004-1060	K15792	BIG/IP is vulnerable to Path MTU discovery attack (CVE-2004-1060)
476738-1	CVE-2007-6199	K15549	rsync daemon may be configured to listen on a public port
430799-3	CVE-2010-5107	K14741	CVE-2010-5107 openssh vulnerability

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
500303-3	2-Critical	K17302	Virtual Address status may not be reliably communicated with route daemon
499947	2-Critical		Improved performance loading thousands of Virtual Servers
497433-2	2-Critical		SSL Forward Proxy server side now supports all key exchange methods.
487552-3	2-Critical		triplets-not-allowed threshold too high because LTM minimum requirements for 6G guests are coming from 8G table
361367-3	2-Critical		Create 8 MB-aligned partitions/volumes for VE images to improve disk I/O.
523803	3-Major		Support two-factor authentication for Citrix Receivers in StoreFront proxy mode
512016-1	3-Major		DB variable added to determine DNS UDP truncation behavior.
504348-1	3-Major	K53152418	iRules in event ADAPT_REQUEST_RESULT or ADAPT_RESPONSE_RESULT cannot see modified headers
502770-2	3-Major		clientside and serverside command crashes TMM
495273-1	3-Major		LDAP extended error info only available at debug log level which could affect Branch rules
480811-2	3-Major	K25171635	qkview will not collect lib directories.
474465-3	3-Major		Analysis processes appear to use high CPU though not affecting data plane

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
510393-1	1-Blocking		TMM may occasionally restart with a core file when deployed VCMP guests are stopped
504490-1	1-Blocking	K16789	The BIG-IP system sometimes takes longer on boot up to become Active.
468175-8	1-Blocking		IPsec interop with Cisco systems intermittent outages
520349	2-Critical		iControl portal restarts
509475	2-Critical		SPDY profile with activation-mode always may not load on upgrade to 11.6.0 or later
509276-4	2-Critical		VXLAN tunnels with floating local addresses generate incorrect gratuitous ARPs on standby device
507487-1	2-Critical		ZebOS Route not withdrawn when VAddr/VIP down and no default pool
505323-1	2-Critical	K17349	NSM hangs in a loop, utilizing 100% CPU
502675-1	2-Critical		Improve reliability of LOP/LBH firmware updates
501343-3	2-Critical		In FIPS HA setup, peer may use the FIPS public-handle instead of the FIPS private-handle
495335-1	2-Critical	K17436	BWC related tmm core
492458-1	2-Critical		BIOS initial release
487233-1	2-Critical	K16747	vCMP guests are unable to access NTP or RSYNC via their management network.
484733-4	2-Critical		aws-failover-tgactive.sh doesn't skip network forwarding virtuals
474751-1	2-Critical		IKEv1 daemon crashes when flushing SAs
474323	2-Critical		ePVA IPv6 feature is not available
467646	2-Critical	K16184	IDE DMA timeouts can result in stuck processes
467196-5	2-Critical	K16015	Log files limited to 24 hours
466266-1	2-Critical		In rare cases, an upgrade (or a restart) can result in an Active/Active state★
460730-7	2-Critical		On systems with multiple blades, large queries can cause TMM to restart
452293-4	2-Critical	K16186	Tunneled Health Monitor traffic fails on Standby device
445911-6	2-Critical		TMM fast forwarded flows are offloaded to ePVA
430323-4	2-Critical		VXLAN daemon may restart when 8000 VXLAN tunnels are configured
422460-8	2-Critical		TMM may restart on startup/config-load if it has too many objects to publish back during config load
376120-4	2-Critical	K15726	tmrouted restart after reconfiguration of previously deleted route domain
519877	3-Major		External pluggable module interfaces not disabled correctly.
516073	3-Major		Revised AWS Setup Guide
514450-4	3-Major		VXLAN: Remote MAC address movement does not trigger ARL updates across TMMs.
512485-3	3-Major		Forwarding of flooded VXLAN-encapsulated unicast frames may introduce additional forwarding
510597-3	3-Major		SNAT Origin Address List is now stored correctly when first created
507461-6	3-Major		Net cos config may not persist on HA unit following staggered restart of both HA pairs.
507327-1	3-Major		Programs that read stats can leak memory on errors reading files
506281	3-Major		F5 Internal tool change to facilitate creating Engineering Hotfixes.
505878	3-Major	K17355	Configuration load failure on secondary blades may occur when the chassis is rebooted
504572-4	3-Major	K30038035	PVA accelerated 3WHS packets are sent in wrong hardware COS queue
503875-1	3-Major	K81433151	Configure bwc policy category max rate
503604-3	3-Major		Tmm core when switching from interface tunnel to policy based tunnel
501953-2	3-Major		HA failsafe triggering on standby device does not clear next active for that device.
501371-4	3-Major	K39672730	mcpd sometimes exits while doing a file sync operation
495862-1	3-Major		Virtual status becomes yellow and gets connection limit alert when all pool members forced down
494978-1	3-Major		The hostagentd daemon should not be running in non-vcmp mode.
494367-2	3-Major		HSB lockup after HiGig MAC reset
491791-3	3-Major		GET on non-existent pool members does not show error
490414-1	3-Major		/shared/vmisolinks present on systems running versions where block-devices are not present
489750-3	3-Major	K16696	Deletion of FIPS keys by-handle may delete key in FIPS-card even if key exists in BIG-IP config
488916	3-Major		CIDR can now be used for SNAT Origin Address List
488374-2	3-Major	K17019	Mismatched IPsec policy configuration causes racoon to core after failed IPsec tunnel negotiation
486512-7	3-Major		audit_forwarder sending invalid NAS IP Address attributes
485939-1	3-Major	K16822	OSPF redistributing connected subnets that are configured in the network element with infinity metric in a HA pair.
485833-7	3-Major		The mcpd process may leak memory when using tmsh to modify user attributes
484861-5	3-Major	K16919	A standby-standby state can be created when auto failback acts in a CRC disagreement scenario
483762-3	3-Major	K15790	Overlapping vCMP guest MAC addresses
483751-1	3-Major	K16729	Internal objects can have load failures on restarted blades
483699-1	3-Major	K16888	No Access error when trying to access iFile object in Local Traffic :: iRules : iFile list
483683-3	3-Major	K16210	MCP continues running after "Unexpected exception caught in MCPProcessor::rm_DBLowHighWide" error
482434	3-Major		Possible performance degradation in AWS cloud
481082-2	3-Major		Software auto update schedule settings can be reset during a full sync
478761-1	3-Major		load sys config default does not work with iCR
477859-1	3-Major		ZebOS config load may fail if password begins with numeric character
477789-4	3-Major		SSL Certificate can accommodate & (ampersand) in the Common Name, Organization Name, Division and SAN.
476288-1	3-Major		Tmrouted restarted after a series of creating/deleting route domains and adding/deleting protocols due to seg fault
473200-2	3-Major		Renaming a virtual server causes unexpected configuration load failure
473037-1	3-Major	K16896	BIG-IP 2000/4000 platforms do not support RSS with L4 data on SCTP
472365-4	3-Major		The vCMP worker-lite system occasionally stops due to timeouts
471496-2	3-Major		Standby node sends a summary LSA for the default route into a stub area with the same metric value as that of Active node.
468517-5	3-Major	K16249	Multi-blade systems can experience active/standby flapping after both units rebooted
464132-2	3-Major	K15665	Serverside SSL cannot be disabled if Rewrite profile is attached
463715-3	3-Major		syscalld logs erroneous and benign timeout messages
447075-1	3-Major		CuSFP module plugged in during links-down state will cause remote link-up
440346-5	3-Major	K16265	Monitors removed from a pool after sync operation
440154-3	3-Major		When IKEv2 is in use, user can only associate one Traffic Selector object with the IKE Peer object
439343	3-Major		Client certificate SSL authentication unable to bind to LDAP server
436682-5	3-Major		Optical SFP modules shows a higher optical power output for disabled switch ports
431634-6	3-Major		tmsh: modify gtm server 'xxx' virtual-servers replace-all-with 'yyy' fails
420204-3	3-Major		FIPS key deletion by-handle does not post an error if corresponding key object exists but the keyname is more than 32 characters long
416292-1	3-Major		MCPD can core as a result of another component shutting down prematurely
394236-3	3-Major		MCP unexpectedly exits, "failure has occurred, There is no active database transaction, status: 0 -
510049	4-Minor		Revised BIG-IP CGNAT Implementations content
493223-3	4-Minor		syscalld core dumps now keep more debugging information
490171-1	4-Minor	K61258430	Cannot add FQDN node if management route is not configured
477111-5	4-Minor		Dual management routes in the main routing table
475592-2	4-Minor		Per-core and system CPU usage graphs do not match
473517-2	4-Minor		'OID not increasing error' during snmpwalk
463959-1	4-Minor		stpd attempts to connect to slots in a chassis that are empty
492422-4	5-Cosmetic	K24508323	HTTP request logging reports incorrect response code
466116-3	5-Cosmetic		Intermittent 'AgentX' warning messages in syslog/ZebOS log files

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
511873	1-Blocking		TMM core observed during SSL cert-related tmsh execution.
507490-1	1-Blocking		Invalid HTTP/2 input can cause the TMM to hang
507139-1	1-Blocking		Invalid HTTP/2 input can cause the TMM to hang
504225-2	1-Blocking		Virtual creation with the multicast IPv6 address returns error message
488931-1	1-Blocking		TMM may restart when MPTCP traffic is being handled.
520413	2-Critical		Aberrant behavior with woodside TCP congestion control
516408-1	2-Critical		SSL reports certificate verification OK even verification returns failure for pcm=request.
516179-1	2-Critical	K16420	Woodside falsely detects congestion
514521	2-Critical		Rare TMM Cores with TCP SACK and Early Retransmit
509310-5	2-Critical		Bad outer IPv4 UDP checksum observed on egressing VxLAN traffic on VIPRION chassis and 5000 series appliances
503620-3	2-Critical		ECDHE_ECDSA and DHE_DSS ciphers do not work with OpenSSL 1.0.1k and later
495875-2	2-Critical	K16204	Connection limit on nodes causes TMM infinite loop and heartbeat failure with heavy traffic
495030-1	2-Critical		Segfault originating from flow_lookup_nexthop.
494319-1	2-Critical	K16811	Proxy SSL caused tmm to core by dereferencing a null pointer
491030-6	2-Critical		Nitrox crypto accelerator can sometimes hang when encrypting SSL records
489796-2	2-Critical	K16298	TMM cores when Woodside congestion control is used.
488908-1	2-Critical	K16808	In client-ssl profile which serves as server side, BIG-IP SSL does not initialize in initialization function.
486450-2	2-Critical		iApp re-deployment causes mcpd on secondaries to restart
485189-3	2-Critical		TMM might crash if unable to find persistence cookie
480699-2	2-Critical	K15728	HA mirroring can overflow buffer limits on larger platforms
480370-6	2-Critical	K17147	Connections to virtual servers with port-preserve property will cause connections to leak in TMM
480299-1	2-Critical	K16627	Delayed update of Virtual Address might not always happen.
480113-4	2-Critical		Install of FIPS exported key files (.exp) causes device-group sync failure
479171-3	2-Critical	K15613	TMM might crash when DSACK is enabled
478983-1	2-Critical	K16809	TMM core during certificate verification against CRL
478592-1	2-Critical	K16798	When using the SSL forward proxy feature, clients might be presented with expired certificates.
477064-1	2-Critical	K17268	TMM may crash in SSL
476683-2	2-Critical		Suspended DNS_RESPONSE events are not resumed
476599-4	2-Critical		TMM may panic when resuming DNS_REQUEST iRule event
475408-1	2-Critical		SSL persistence profile does not find the server certificate.
475231-5	2-Critical		TCP::close in CLIENTSSL_CLIENTCERT iRule event may result in tmm crash
474974-3	2-Critical		Fix ssl_profile nref counter problem.
474388-3	2-Critical	K16957	TMM restart, SIGSEGV messages, and core
472585-3	2-Critical		tmrouted crashes after a series configuration changes
470191-2	2-Critical	K15760	Virtual with FastL4 with loose initiation and close enabled might result in TMM core
417068-6	2-Critical		Key install or deletion failure on FIPS key names longer than 32 chars on some platforms
517124	3-Major		HTTP::retry incorrectly converts its input
516292-1	3-Major	K17023	Incorrect handling of repeated headers
515482	3-Major	K93258439	Multiple teardown conditions can cause crash
514604-1	3-Major	K17467	Nexthop object can be freed while still referenced by another structure
513243-1	3-Major	K17561	Improper processing of crypto error condition might cause memory issues.
512490-3	3-Major	K16601	Increased latency during connection setup when using FastL4 profile and connection mirroring.
511517-1	3-Major	K17111	Request Logging profile cannot be configured with HTTP transparent profile
511130-3	3-Major		TMM core due to invalid memory access while handling CMP acknowledgement
509416	3-Major		Suspended 'after' commands may result in unexpected behaviors
508716-4	3-Major		DNS cache resolver drops chunked TCP responses
507127-2	3-Major		DNS cache resolver is inserted to a wrong list on creation.
506702-4	3-Major		TSO can cause rare TMM crash.
506290-4	3-Major		MPI redirected traffic should be sent to HSB ring1
505964	3-Major		Invalid http cookie handling can lead to TMM core
505056-5	3-Major		BIG-IP system might send an egress packet with a priority different from that of ingress packet on the same flow.
504633-1	3-Major		DTLS should not update 'expected next sequence number' when the record is bad.
503741-2	3-Major	K16662	DTLS session should not be closed when it receives a bad record.
503214-3	3-Major		Under heavy load, hardware crypto queues may become unavailable.
503118-2	3-Major		clientside and serverside command crashes TMM
502959-2	3-Major		Unable get response from virtual server after node flapping
502683-3	3-Major		Traffic intermittently dropped in syncookie mode, especially when hardware syncookie is on
502149-3	3-Major	K06334742	Archiving EC cert/key fails with error 'EC keys are incompatible for Webserver/EM/iQuery.'
501690-3	3-Major		TMM crash in RESOLV::lookup for multi-RR TXT record
499950-5	3-Major		In case of intra_cluster ha, node flapping may still lead to inconsistent persistence entries across TMMs
499946-3	3-Major	K16801	Nitrox might report bad records on highly fragmented SSL records
499478-2	3-Major	K16850453	Bug 464651 introduced change-in-behavior for SSL server cert chains by not including the root certificate
499280-1	3-Major		Client side or server side SSL handshake may fail if it involves SHA512-signed certificates in TLS1.2
499150-3	3-Major	K16721	OneConnect does not reuse existing connections in VIP targeting VIP configuration
498334-2	3-Major	K16867	DNS express doesn't send zone notify response
498269-1	3-Major	K16856	5200 does not forward STP BPDUs across VLAN groups when in PASSTHRU mode
497584-2	3-Major		The RA bit on DNS response may not be set
496950-1	3-Major		Flows may not be mirrored successfully when static routes and gateways are defined.
496588-1	3-Major		HTTP header that is larger than 64K can be analyzed incorrectly, leading to TMM crash
495574-3	3-Major	K16111	DB monitor functionality might cause memory issues
495443-4	3-Major		ECDH negotiation failures logged as critical errors.
495253-1	3-Major	K16603	TMM may core in low memory situations during SSL egress handling
494322-6	3-Major		The HTTP_REQUEST iRule event may cause the TMM to crash if the explicit proxy is used
493673-2	3-Major	K12352524	DNS record data may have domain names compressed when using iRules
493140-1	3-Major	K16969	Incorrect persistence entries are created when invoking cookie hash persistence within an iRule using offset and length parameters.
493117-6	3-Major	K16986	Changing the netmask on an advertised virtual address causes it to stop being advertised until tmrouted is restarted
491518-2	3-Major		SSL persistence can prematurely terminate TCP connection
491454-6	3-Major		SSL negotiation may fail when SPDY profile is enabled
490817-1	3-Major		SSL filter might report codec alerts repeatedly
490480-3	3-Major		UCS load may fail if the UCS contains FIPS keys with names containing dot★
490129-1	3-Major	K16740	SMTP monitor could not create socket on IPv6 node address
488598-1	3-Major	K16631	SMTP monitor on non-default route domain fails to create socket
487757	3-Major		Hybrid higig/front panel port packet discard (Ingress back-pressure v.s. Egress queue discard) counts can be expected during bursty or severe MMU traffic congestion on B4300/B2200/10000/12000-family platforms.
487592	3-Major	K65442255	Change in the caching duration of OCSP response when there is an error
487587-2	3-Major		The allowed range of 'status-age' in OCSP Stapling Parameters (for clientSSL OCSP Stapling) might not be wide enough for some of the scenarios
487554-2	3-Major	K41581381	System might reuse TCP source ports too quickly on the server side.
486724-3	3-Major	K16750	After upgrading from v10 to v11 in a FIPS HA setup, config-sync fails★
484305-2	3-Major	K16733	Clientside or serverside command with parking command crashes TMM
483539-1	3-Major		With fastL4, incorrect MSS value might be used if SYN has options without MSS specified
483353-1	3-Major		HTTP compression might cause TMM crash in low-memory conditions
481880-5	3-Major		SASPD monitor cores
481216-1	3-Major		Fallback may be attempted incorrectly in an abort after an Early Server Response
480686-7	3-Major	K15781	Packet loop in VLAN Group
480443-1	3-Major	K17464	Internal misbehavior of the SPDY filter
479682-4	3-Major	K16862	TMM generates hundreds of ICMP packets in response to a single packet
479176-1	3-Major	K16824	TMM hangs and receives SIGABRT due to race condition during DNS db load
478840-1	3-Major	K17014	Cannot delete keys in subfolders using the BIG-IP GUI
478734-5	3-Major		Incorrect 'FIPS import for failed for key' failure when operation actually succeeds
478195-4	3-Major		Installation of FIPS .exp key files sets incorrect public exponent.
477375-5	3-Major		SASP Monitor may core
475791-4	3-Major	K16171	HTTP caching configured in a Web Acceleration profile may dispatch internal messages out-of-order, leading to assert
475322-2	3-Major		cur_conns number different in tmstat and snmp output.
474584-2	3-Major	K16261	igbvf driver leaks xfrags when partial jumbo frame received
474226-2	3-Major		LB_FAILED may not be triggered if persistence member is down
474002-4	3-Major	K15972	Server SSL profile unable to complete SSL handshake when server selects DHE-based key exchange, and is configured with 2048-bit or larger DH keys
473759-1	3-Major		Unrecognized DNS records can cause mcpd to core during a DNS cache query
472148-7	3-Major		Highly fragmented SSL records can result in bad record errors on Nitrox based systems
471821-1	3-Major		Compression.strategy "SIZE" is not working
471625-8	3-Major		After deleting external data-group, importing a new or editing existing external data-group does not propagate to TMM
470394-2	3-Major	K16242	Priority groups may result in traffic being load balanced to a single pool member.
469705-4	3-Major		TMM might panic when processing SIP messages due to invalid route domain
469115-3	3-Major	K75513721	Management client-ssl profile does not support multiple key/cert pair.
468472-7	3-Major		Unexpected ordering of internal events can lead to TMM core.
467868-3	3-Major	K15959	Leak due to monitor status reporting
464651-2	3-Major	K16636	Multiple root certificates with same 'subject' and 'issuer' may cause the tmm to core.
464163-3	3-Major	K15988	Customized cert-key-chain of a client ssl profile might be reverted to its parent's.
457934-4	3-Major		SSL Persistence Profile Causing High CPU Usage
456763-5	3-Major		L4 forwarding and TSO can cause rare TMM outages
456413-5	3-Major		Persistence record marked expired though related connection is still active
455840-7	3-Major		EM analytic does not build SSL connection with discovered BIG-IP system
449891-7	3-Major		Fallback source persistence entry is not used when primary SSL persistence fails
447272-2	3-Major	K17288	Chassis with MCPD audit logging enabled will sync updates to device group state
444710-6	3-Major		Out-of-order TCP packets may be dropped
443006-1	3-Major		In low memory situations initializing the HTTP parser will cause the TMM to crash
438792-5	3-Major		Node flapping may, in rare cases, lead to inconsistent persistence behavior
428163-3	3-Major		Removing a DNS cache from configuration can cause TMM crash
384451-6	3-Major		Duplicated cert/keys/chain might cause SIGABRTs and low-memory conditions
503560-2	4-Minor		Statistics profiles cannot be configured along with HTTP transparent profile on the same virtual server.
498597-5	4-Minor	K16761	SSL profile fails to initialize and might cause SSL operation issues
481820-1	4-Minor		Internal misbehavior of the SPDY filter
480888-2	4-Minor	K51148522	Tcl parks during HTTP::collect, and serverssl is present, data can be truncated
469739-4	4-Minor	K16218	ConfigSync may fail if HA pair has dissimilar cert-key-chain sub-object names within an SSL profile
463696-5	4-Minor		FIPS keys might not be recoverable from UCS
451224-3	4-Minor		IP packets that are fragmented by TMM, the fragments will have their DF bit

Performance Fixes

ID Number	Severity	Solution Article(s)	Description
476144-1	1-Blocking		TMM generates a core file when dynamically loading a shared library.
497619-6	3-Major	K16183	TMM performance may be impacted when server node is flapping and persist is used
426939-5	3-Major	K15337	APM Polices does not work in VIPRION 4800 chassis if there is no slot1

Global Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
477240-2	2-Critical		iQuery connection resets every 24 hours
468519-1	3-Major		BIG-IP DNS configuration load failure from invalid bigip_gtm.conf file.
491554-2	4-Minor	K54162409	[big3d] Possible memory leakage for auto-discovery error events.

Application Security Manager Fixes

ID Number	Severity	Solution Article(s)	Description
488306-1	1-Blocking		Requests not logged locally on the device
478674-1	1-Blocking	K08359230	ASM internal parameters for high availability timeout was not handled correctly
516523-2	2-Critical		Full ASM Config Sync was happening too often in a Full Sync Auto-Sync Device Group
515433-1	2-Critical	K16639	BD crash on specific signature sets configuration.
512616-1	2-Critical		BD crash during brute force attack on cluster environement
508908-1	2-Critical		Enforcer crash
507919-1	2-Critical		Updating ASM through iControl REST does not affect CMI sync state
506372	2-Critical		XML validation files related errors on upgrade
504182-1	2-Critical		Enforcer cores after upgrade upon the first request★
503169-1	2-Critical		XML validation files are broken after upgrade★
493401-2	2-Critical		Concurrent REST calls on a single endpoint may fail
492978-1	2-Critical		All blades in a cluster remain offline after provisioning ASM or FPS
487420-1	2-Critical		BD crash upon stress on session tracking
486323-1	2-Critical	K16817	The datasyncd process may keep restarting during the first 30 minutes following a hotfix installation
481476-5	2-Critical		MySQL performance
517245-2	3-Major		A request that should be blocked was forwarded to the server
515449-1	3-Major		bd agent listens on all addresses instead of the localhost only
515190-2	3-Major		Event Logs -> Brute Force Attacks can't show details after navigating to another page
514093-1	3-Major		Allow request logs to be filtered by destination IP
513763	3-Major		Slow response from GUI when listing Event Logs
512668-1	3-Major		ASM REST: Unable to Configure Clickjacking Protection via REST
512001-1	3-Major		Using REST API to Update ASM Attack Signatures Fails
512000-1	3-Major		Event Log Filter using Policy Group isn't accurate
511947-1	3-Major	K24475274	Policy auto-merge of Policy Diff
511488-1	3-Major		Correlation restarting on a multi-bladed vCMP guest
511477-2	3-Major		Manage ASM security policies from BIG-IQ
510499-2	3-Major	K17544	System Crashes after Sync in an ASM-only Device Group.
509968-3	3-Major		BD crash when a specific configuration change happens
509873-1	3-Major	K01443011	Rare crash and core dump of TMM or bd after rebooting a device or joining a trust domain.
509495	3-Major		A TMM memory leak when HTTP protocol security enabled profile and no AFM license
508519-4	3-Major		Performance of Policy List screen
508338-1	3-Major		Under rare conditions cookies are enforced as base64 instead of clear text
507905	3-Major		Saving Policy History during UCS load causes DB deadlock/timeout★
507902-1	3-Major	K16697	Failure and restart of mcpd in secondary blade when cluster is part of a trust domain.
507289-3	3-Major		User interface performance of Web Application Security Editor users
506407	3-Major	K04420402	Certain upgrade paths to 11.6.x lose the redirect URL configuration for Alternate Response Pages★
506386-2	3-Major		Automatic ASM sync group remains stuck in init state when configured from tmsh
506355-1	3-Major		Importing an XML file without defined entity sections
506110-1	3-Major	K25430927	Log flood within datasyncd.log in clustered environment
504973-1	3-Major		Configuring a route domain with 32 bit subnet mask, 128 bit mask saved instead
504718-2	3-Major	K75221274	Policy auto-merge of Policy Diff
502852-2	3-Major		Deleting an in-use custom policy template
501612-4	3-Major		Spurious Configuration Synchronizations
500544-1	3-Major		XML validation files are not correctly imported/upgraded
498708-1	3-Major		Errors logged in bd.log coming from the ACY module
498189-3	3-Major		ASM Request log does not show log messages.
497769	3-Major		Policy Export: BIG-IP does not export redirect URL for "Login Response Page"
496565-1	3-Major		Secondary Blades Request a Sync
496264-1	3-Major		SOAP Methods Were Not Being Validated For WSDL Based XML Profiles
490284-3	3-Major	K17383	ASM user interface extremely slow to respond (e.g. >2 minutes to render policy list)
489648-1	3-Major		Empty violation details for attack signatures
485764-5	3-Major	K17401	WhiteHat vulnerability assessment tool is configured but integration does not work correctly
484079-1	3-Major	K90502502	Change to signature list of manual Signature Sets does not take effect.
482915-1	3-Major	K17510	Learning suggestion for the maximum headers check violation appears only for blocked requests
475819-4	3-Major	K17325	BD crash when trying to report attack signatures
471103-1	3-Major	K10340625	Ignoring null values for parameters with different content types

Application Visibility and Reporting Fixes

ID Number	Severity	Solution Article(s)	Description
508544-1	3-Major		AVR injects CSPM JavaScript when the payload does not contain an HTML <head> tag
504414-1	3-Major		AVR HTTP External log - missing fields
503683	3-Major		Configuration upgrade failure due to change in an ASM predefined report name★
503471-1	3-Major	K17395	Memory leak can occur when there is a compressed response, and abnormal termination of the connection
500457-1	3-Major		Synchronization problem in AVR lookups that sometimes causes TMM and other daemons, such as the Enforcer, to crash
500034-1	3-Major		[SMTP Configuration] Encrypted password not shown in GUI
497681-1	3-Major		Tuning of Application DoS URL qualification criteria
497376-1	3-Major		Wrong use of custom XFF headers when there are multiple matches
488713-1	3-Major		Corrupt memory

Access Policy Manager Fixes

ID Number	Severity	Solution Article(s)	Description
497662-3	1-Blocking		BIG-IP DoS via buffer overflow in rrdstats
517146-1	2-Critical		Log ID 01490538 may be truncated
516075-6	2-Critical		Linux command line client fails with on-demand cert
513795-1	2-Critical		HTML5 client is not available on APM Full Webtop when using VMware Horizon 6.1
507782-1	2-Critical		TMM crashes for Citrix connection when Address field in the ICA file has non-patched/invalid data
506235-2	2-Critical		TMM Crash
497436-4	2-Critical		Mac Edge Client behaves erratically while establishing network access connection
496894-1	2-Critical		TMM may restart when accessing SAML resource under certain conditions.
495901-3	2-Critical		Tunnel Server crash if probed on loopback listener.
493360-1	2-Critical		Fixed possible issue causing Edge Client to crash during reconnect
489328-9	2-Critical		When BIG-IP virtual accessed with multiple tabs with long initial URLs before session creation can cause TMM crash.
473092-1	2-Critical		Transparent Proxy + On-Demand Cert Auth will reset
431980-1	2-Critical	K17310	SWG Reports: Overview and Reports do not show correct data.
515387	3-Major		Update EPSEC package to latest verified in 11.6.0 branch
514636-1	3-Major	K17137	SWG Category Lookup using Subject.CN results in a crash if the certificate presented does not have a Subject.CN.
514277-1	3-Major		Provide a way to enable connection bar for Citrix desktops only
513646-1	3-Major	K37170914	APM(ACCESS)/SWG filter might process SessionDB replies after flow has been aborted resulting in orphaned timer
512999-1	3-Major	K17432	LDAP Query may fail if user belongs to a group from foreign domain
512378-1	3-Major		Changing per request policy in the middle of data traffic can cause TMM to crash
511961-1	3-Major		BIG-IP Edge Client does not display logon page for FirePass
511648-2	3-Major	K16959	On standby TMM can core when active system sends leasepool HA commands to standby device
511441-3	3-Major	K17564	Memory leak on request Cookie header longer than 1024 bytes
509956-4	3-Major		Improved handling of cookie values inside SWG blocked page.
509758-2	3-Major		EdgeClient shows incorrect warning message about session expiration
509010	3-Major		Adding/Deleting a local user takes 30 seconds to complete
508719-1	3-Major	K22391125	APM logon page missing title
508630-4	3-Major		The APM client does not clean up DNS search suffixes correctly in some cases
507899	3-Major		Custom APM report - Assigned IP field shows 'IPv4' instead of assigned IP value
507318-3	3-Major		JS error when sending message from DWA new message form using Chrome
507116-1	3-Major	K17030	Web-application issues and/or unexpected exceptions.
506349-4	3-Major		BIG-IP Edge Client for Mac identified as browser by APM in some cases
505797-1	3-Major		Citrix Receiver for Android fails to authenticate with APM configured as StoreFront proxy and Access Gateway
505755-3	3-Major	K11043155	Some scripts on dynamically loaded html page could be not executed.
504880-2	3-Major		TMM may crash when RDP client connects to APM configured as Remote Desktop Gateway
504606-3	3-Major		Session check interval now has minimum value
503319-4	3-Major	K16901	After network access is established browser sometimes receives truncated proxy.pac file
502441-5	3-Major		Network Access connection might reset for large proxy.pac files.
502016-4	3-Major		MAC client components do not log version numbers in log file.
501498-1	3-Major		APM CTU doesn't pick up logs for Machine Certificate Service
499620-6	3-Major		BIG-IP Edge Client for MAC shows wrong SSL protocol version; does not display the protocol version that was negotiated.
499427-1	3-Major		Windows File Check does not work if the filename starts with an ampersand
498993-1	3-Major	K16972	it is possible to get infinite loop in LDAP Query while resolving nested groups
498782-2	3-Major	K17104	Config snapshots are deleted when failover happens
498469-5	3-Major		Mac Edge Client fails intermittently with machine certificate inspection
497455-1	3-Major		MAC Edge client crashed during routine Network Access.
497325-1	3-Major	K16643	New users cannot log in to Windows-based systems after installing BIG-IP EDGE client in certain deployment
496817-1	3-Major		Big-IP Edge client for Windows fails to connect to Firepass server if tunnel is established through a proxy
495702-4	3-Major	K40419383	Mac Edge Client cannot be downloaded sometimes from management UI
495319-3	3-Major		Connecting to FP with APM edge client is causing corporate network to be inaccessible
495265-1	3-Major		SAML IdP and SP configured in same access profile not supported
494176-5	3-Major		Network access to FP does not work on Yosemite using APM Mac Edge Client.
494088-4	3-Major		APD or APMD should not assert when it can do more by logging error message before exiting.
490844-4	3-Major	K50522620	Some controls on a web page might stop working.
490681-1	3-Major	K17470	Memcache entry for dynamic user leaks
490675-1	3-Major	K16855	User name with leading or trailing spaces creates problems.
489382-7	3-Major		Machine Cert allows mismatched SubjectCN and FQDN for browsers in case of valid cert
487170-1	3-Major		Enahnced support for proxy servers that resolve to multiple IP addresses
486597-1	3-Major		Fixed Network Access renegotiation procedure
486268-1	3-Major		APM logon page missing title
485355-3	3-Major		Click-to-Run version of Office 2013 does not work inside PWS (Protected WorkSpace)
484582-2	3-Major		APM Portal Access is inaccessible.
483526-1	3-Major		Rarely seen Edge Client for Mac crash on session disconnect
482269-1	3-Major		APM support for Windows 10 out-of-the-box detection
480817-3	3-Major		Added options to troubleshoot client by disabling specific features
480242-5	3-Major		APD, APMD, MCPD communication error failure now reported with error code
477898-1	3-Major		Some strings on BIG-IP APM EDGE Client User Interface were not localized
477795-1	3-Major		SSL profile passphrase may be displayed in clear text on the Dashboard
476038-1	3-Major		Mac Edge Client crashes on OS X 10.7 if a user adds new server using its IP address rather than DNS name
475505-6	3-Major		Windows Phone 8.1 built-in browser is not properly detected by BIG-IP system.
474698-2	3-Major		BIG-IP as IdP can send incorrect 'Issuer' element for some SLO requests under certain conditions.
474582-3	3-Major		Add timestamps to logstatd logs for Policy Sync
473697-6	3-Major		HD Encryption check should provide an option to choose drive
473129-5	3-Major	K15943	httpd_apm access_log remains empty after log rotation
471421-5	3-Major	K16270	Ram cache evictions spikes with change of access policy leading to slow webtop rendering
471331-2	3-Major		APM::RBA reset due to a leaked HUDEVT_REQUEST_DONE
460715-5	3-Major		Changes in captive portal probe URL
452464-4	3-Major	K28271912	iClient does not handle multiple messages in one payload.
452416-1	3-Major		tmctl leasepool_stat and snmp apmLeasepoolStatTable return incorrect values
437744-4	3-Major	K15186	SAML SP service metadata exported from APM may fail to import.
437743-6	3-Major		Import of Access Profile config that contains ssl-cert is failing
436201-6	3-Major		JavaScript can misbehave in case of the 'X-UA-Compatible' META tag when a client uses IE11
433972-13	3-Major		New Event dialog widget is shifted to the left and Description field does not have action widget
433847-1	3-Major		APD crashes with a segmentation fault.
432900-9	3-Major		APM configurations can fail to load on newly-installed systems★
431149-6	3-Major	K17217	APM config snapshot disappears and users see "Access Policy configuration has changed on gateway"
416115-14	3-Major		Edge client continues to use old IP address even when server IP address changed
410089-2	3-Major		Linux client hangs after receiving the application data
403991-8	3-Major		Proxy.pac file larger than 32 KB is not supported
510596-6	4-Minor		Broken DNS resolution on Linux client when "DNS Default Domain Suffix" is empty
505662-1	4-Minor		Signed SAML IdP/SP exported metadata contains some elements in wrong order
504461-2	4-Minor		Logon Page agent gets empty user input in clientless mode 3 when a Variable Assign agent resides in front of it.
485202-1	4-Minor		LDAP agent does not escape '=' character in LDAP DN
482134-1	4-Minor		APD and APMD cores during shutdown.
471452-2	4-Minor		Access policy in progress with multiple tabs, landing URL set to the tab in which policy is completed.
465012-4	4-Minor		Rewrite plugin may crash if webtrace or debug log level is enabled for Portal Access
464992-7	4-Minor		Mac Edge fails to pass machine certificate inspection if domain component is included in search criteria
461597-11	4-Minor		MAC edge client doesn't follow HTTP 302 redirect if new site has untrusted self-signed certificate
460427-2	4-Minor		Address collision reported when the Primary blade goes down or its TMM crashes in an Chassis IntraCluster environment.
456911-3	4-Minor		Add BIG-IP hostname to system's static DNS host entries
493385-6	5-Cosmetic		BIG-IP Edge Client uses generic icon set even if F5 icon set is configured

WebAccelerator Fixes

ID Number	Severity	Solution Article(s)	Description
514838-1	1-Blocking		TMM Crash on Relative URL
514785-2	1-Blocking		TMM crash when processing AAM-optimized video URLs
486346-3	2-Critical		Prevent wamd shutdown cores
447254-1	2-Critical		Core in parked transaction due to evicted stand-in document
511534-1	3-Major	K44288136	A large number of regular expressions in match rules on path-segments may cause an AAM policy to take too long to load,
481431-1	3-Major		AAM concatenation set memory leak on configuration change
467633-5	3-Major		WAM CSS minification can add spaces to the output, potentially coring TMM (in rare cases)
488917-2	4-Minor		Potentially confusing wamd shutdown error messages

Service Provider Fixes

ID Number	Severity	Solution Article(s)	Description
486356-1	2-Critical	K16807	unable to configure a virtual with stats profile and sip profile in 11.6.0
482436-1	2-Critical	K16973	BIG-IP processing of invalid SIP request may result in high CPU utilization
478442-5	2-Critical		Core in sip filter due to sending of HUDEVT message while processing of HUDCTL message
477318-1	2-Critical		Fixes possible segfault
466761-4	2-Critical		Heartbeat, UDP packet with only double CRLF, on existing SIP flow results in connection loss.
455006-7	2-Critical	K50532341	Invalid data is merged with next valid SIP message causing SIP connection failures
512054-1	3-Major	K17135	CGNAT SIP ALG - RTP connection not created after INVITE
511326-2	3-Major	K24410405	SIP SUBSCRIBE message not forwarded by BIG-IP when configured as SIP ALG with translation.
507143-1	3-Major	K17071	Diameter filter may process HUDCTL_ABORT message before processing previously queued events leading to tmm assertion
503676-4	3-Major		SIP REFER, INFO, and UPDATE request do not trigger SIP_REQUEST or SIP_REQUEST_SEND iRule events
500365-3	3-Major		TMM Core as SIP hudnode leaks
499701-1	3-Major		SIP Filter drops UDP flow when ingressq len limit is reached.
472376-3	3-Major	K17190	A SIP virtual server may crash while trying to send a message if the connection is in the process of shutting down
448493-10	3-Major		SIP response from the server to the client get dropped

Advanced Firewall Manager Fixes

ID Number	Severity	Solution Article(s)	Description
515562-1	2-Critical	K16813	Sweep and flood may crash if it is enabled when AFM is not licensed or provisioned.
513403-1	2-Critical	K16490	TMM asserts when certain ICMP packets (e.g multicast echo) are classified by AFM and match rules at Global and Route Domain context with logging enabled for these rules and also log-translations is enabled in AFM Logging configuration.
512609	2-Critical		Firewall rules specifying wildcard IPv6 addresses match IPv4 addresses
503541-2	2-Critical		Use 64 bit instead of 10 bit for Rate Tracker library hashing.
501480-3	2-Critical		AFM DoS Single Endpoint Sweep and Flood Vectors crash TMM under heavy traffic.
500925-3	2-Critical		Introduce a new sys db variable to control number of merges per second of Rate Tracker library.
517019-1	3-Major		AVR-HTTP (and Application DoS): Detection of pool-member is sometimes incorrect
515187-2	3-Major		Certain ICMP packets are evaluated twice against Global and Route Domain ACL rules.
513565-1	3-Major		AFM Kill-on-the-fly does not re-evaluate existing flows against any Virtual/SelfIP ACL policies if a Global or Route-Domain rule action is modified from Accept-Decisively to Accept.
511406-1	3-Major	K16421	Pagination issue on firewall policy rules page
505624-1	3-Major		Remote logger will continue to get DoS L7 messages after it was removed from the virtual server configuration
503085-3	3-Major		Make the RateTracker threshold a constant
502414-2	3-Major		Make the RateTracker tier3 initialization number less variant.
501986-3	3-Major		Add a sys db tunable to make Sweep and Flood vectors be rate-limited per TMM process
496278-2	3-Major	K16294	Disabling/enabling Rule within Rule List causes disabling/enabling of other Rule with the same name
500449	4-Minor		"Any IPv4 or IPv6" choice in sweep attack has atypical definition
497311	4-Minor		Can't add a ICMPv6 type and code to a FW rule.

Policy Enforcement Manager Fixes

ID Number	Severity	Solution Article(s)	Description
519407-1	2-Critical		PEM session lookup by subscriber ID in TMSH fails if same IP is being used to create session with different subscriber ID
518967-1	2-Critical	K45215234	Possible error when parsing for certain URL categorization input.
508051-1	2-Critical	K53394418	DHCP response may return to wrong DHCP client.
506734	2-Critical		Cloud lookup stress condition
506283	2-Critical		100% TPS drop when webroot cloud lookup is enabled under stress condition
505529	2-Critical		wr_urldbd restarts continuously on VIPRION chassis with webroot lookup enabled.
505069	2-Critical		Webroot cloud lookup granularity
503381-2	2-Critical		SSL persistence may cause connection resets
500219-1	2-Critical		TMM core if identical radius starts messages received
496976-2	2-Critical		Crash when receiving RADIUS message to update PEM static subscriber.
484278-4	2-Critical	K16734	BIG-IP crash when processing packet and running iRule at the same time
480544-1	2-Critical		Secondary IP flows are not forwarded in multiple IP session
473680-1	2-Critical	K17559	Multiple DHCP solicit packets may not succeed.
515638	3-Major		5% drop in Webroot cloud lookup performance with mixed upper/lowercase URLs
512734	3-Major		Socket error when Webroot cloud lookup is enabled under stress condition
511064-1	3-Major	K17108	Repeated install/uninstall of policy with usage monitoring stops after second time
510811-1	3-Major		PEM::info irule does not take effect if used right after PEM::session config policy irule
510721-1	3-Major		PEM::enable / PEM::disable iRule errors out with an error message
509105-1	3-Major	K74503799	TMM cores sometimes if provisioning hold time is set to non-zero.
507753	3-Major		URL categorization missed if HTTP1.0 header does not have HOST
507549-1	3-Major		PEM may ignore a RAR if the target session is in the Provision-Pending state
506578	3-Major		Webroot cloud lookup does not yield a category.
505986	3-Major		Extra Webroot cloud lookup requests when cache is full
504028-1	3-Major		Generate CCR-T first and then CCR-I if session being replaced
495913-2	3-Major		TMM core with CCA-I policy received with uninstall
488166-1	3-Major		Provide an option to delete the session if IP class address Limit reached when new IP being added and create a new one instead.
467106-1	3-Major		Loading ucs file after install 11.6.0 on top of 11.5.0 failed when Gx reporting is enabled.★
512663	4-Minor		Added urlcatblindquery iRule command
489767	4-Minor		Webroot cloud lookup support
478399-2	4-Minor		PEM subscriber sessions are created without PEM licensed, if "radiusLB-subscriber-awre" profile is configured.

Carrier-Grade NAT Fixes

ID Number	Severity	Solution Article(s)	Description
519723	2-Critical		dnatutil utility needs update because DAG changed.
494280-3	2-Critical	K16256	TMM crashes when PPTP finds a redirected flow when checking for an existing tunnel
493807-5	2-Critical	K15989	TMM might crash when using PPTP with profile logging enabled
482202-1	3-Major		Very long FTP command may be ignored.

Fraud Protection Services Fixes

ID Number	Severity	Solution Article(s)	Description
487553	3-Major		FPS alerts

Global Traffic Manager (DNS) Fixes

ID Number	Severity	Solution Article(s)	Description
499719-1	3-Major		Order Zones statistics would cause database error
475549-3	3-Major		Input handling error in GTM GUI
475092	3-Major		Viewing DNS::Zones:Zones:Zones List:Statistics in the GUI generates error.
494305-3	4-Minor	K36360597	[GUI] [GTM] Cannot remove the first listed dependent virtual server from dependency list.

Anomaly Detection Services Fixes

ID Number	Severity	Solution Article(s)	Description
461949	2-Critical	K16431	Virtual server with Portal Access and DOS profile resets connection

Traffic Classification Engine Fixes

ID Number	Severity	Solution Article(s)	Description
513215	2-Critical		Only one of the TMMs load the classification library after an IM package upgrade
508660-1	2-Critical		Intermittent TMM crash in classification library
484483-2	2-Critical		TCP and UDP was classified as Unknown by classification library

Cumulative fixes from BIG-IP v11.6.0 Hotfix 4 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
503237-8	CVE-2015-0235	K16057	CVE-2015-0235 : glibc vulnerability known as Ghost
496849-1	CVE-2014-9326	K16090	F5 website update retrievals vulnerability
494078-4	CVE-2014-9326	K16090	Update Check feature can be target of man-in-middle-attack
492368-5	CVE-2014-8602	K15931	Unbound vulnerability CVE-2014-8602
492367-4	CVE-2014-8500	K15927	BIND vulnerability CVE-2014-8500
489323-1	CVE-2015-8098	K43552605	Out-of-bounds memory access when 'remotedesktop' profile is assigned to a virtual server.
485812-2	CVE-2014-3660	K15872	libxml2 vulnerability CVE-2014-3660
477274-8	CVE-2014-6031	K16196	Buffer Overflow in MCPQ
500088-1	CVE-2014-3571	K16123	OpenSSL Vulnerability (January 2015) - OpenSSL 1.0.1l update
497719-1	CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296,	K15934	NTP vulnerability CVE-2014-9293, NTP vulnerability CVE-2014-9294, NTP vulnerability CVE-2014-9295, and NTP vulnerability CVE-2014-9296
496845-1	CVE-2014-9342	K15933	NTP vulnerability CVE-2014-9296
482710-4	CVE-2014-3566	K15702	SSLv3 protocol disabled in APM clients
474757-15	CVE-2014-3508 CVE-2014-5139 CVE-2014-3509 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512	K15573	OpenSSL DTLS vulnerabilities CVE-2014-3505, CVE-2014-3506, and CVE-2014-3507, OpenSSL vulnerability CVE-2014-3508, OpenSSL vulnerability CVE-2014-3510, TLS vulnerability CVE-2014-3511.
471014-14	CVE-2014-2970 CVE-2014-5139	K15567	OpenSSL vulnerability CVE-2014-5139

Functional Change Fixes

ID Number	Severity	Solution Article(s)	Description
480583-1	2-Critical		Support SIP/DNS DOS only for UDP packets and SIP DOS does not drop packets but count drops
477524	3-Major		Enable ssh for admin account and disable ssh for root account for Amazon deployments

TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
493275-3	1-Blocking		Restoring UCS file breaks auto-sync requiring forced sync.
483436-1	1-Blocking		Update 11.5.0 license files for "hourly billing" with production licenses.
482943-1	1-Blocking		Cannot upgrade because of lack of root/admin access.
476126-1	1-Blocking	K16683	Adding SR-IOV and VLAN tagging in the F5 VE with Emulex NIC
475829-1	1-Blocking		AWS - VE is locked out after live install on 2nd slot.
499880	2-Critical		boot menu titles might not contain volume suffix
487567-4	2-Critical		Addition of a DoS Profile Along with a Required Profile May Fail
486137-3	2-Critical		License activation may not proceed if MCPD is not fully operational★
484399-2	2-Critical	K16048	Virtual Edition second installation slot and VMWare
478896	2-Critical		Hourly Billing AMIs for 11.6.0 contain internal instead of production license
477031-2	2-Critical		Deleting multiple VXLAN tunnels with flooding type multipoint can cause TMM restart
473641-1	2-Critical		Missing a tunnel FDB endpoint configuration in VXLAN tunnels could result in memory leak
497870-1	3-Major		PEM configured with BWC doing pem policy changes could trigger leak
497062-1	3-Major	K16964	PEM configured with BWC doing PEM policy changes could trigger leak
492809-4	3-Major	K16166	Small but continuous mcpd memory leak associated with statistics.
485352-1	3-Major		TMM dumps core file when loading configuration or starting up
483228-3	3-Major		The icrd_child process generates core when terminating
479359-1	3-Major		Loading a UCS file with no-platform-check stalls at platform check★
479302-3	3-Major	K16641	Error message in ltm log: bcm56xxd: reading L2 entry Operation failed bs_arl.cpp.
479152-5	3-Major	K15888	Hardware parity error mitigation on 10000s/10200v/10250v platforms and B4300/B4340N and B2250 blades
474172	3-Major		BIG-IQ at times cannot discover BIG-IP running TMOS 11.6.0 - 11.6.0 HF3, failure reason: Failed getting time zone.
474166-4	3-Major		ConfigSync operation failing with rarely occurring sFlow error
473409-1	3-Major		Route domain stats can not be reset by using F5-BIGIP-LOCAL-MIB::ltmRouteDomainStatResetStats
468514-4	3-Major	K16000	Receiving several ConfigSync requests in a short period of time may cause the mcpd process to restart and produce a core file
468021-3	3-Major		UCS file from earlier version may not load into 11.5.0 or later image★
481135-1	4-Minor	K15818	The pool members of a wide IP in Link Controller can not be modified once created
441512-4	4-Minor	K15840	ConfigSync failing with sFlow error

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
490225-3	2-Critical	K16030	Duplicate DNSSEC keys can cause failed upgrade.★
484948-1	2-Critical	K16732	UDP connflow may aborted from parked iRule in server_closed.
478812-2	2-Critical		DNSX Zone Transfer functionality preserved after power loss
502174-4	3-Major		DTLS fragments do not work for ClientHello message.
484429-4	3-Major		After updating a key/certificate in place and synchronizing the configuration, TMM may log critical-level messages that it could not load a key, certificate, or chain.
483974-2	3-Major		Unrecognized EDNS0 option may be considered malformed.
483328-4	3-Major	K15851	Client SSL profiles might fail to complete handshake, system logs critical-level error '01260000:2: Profile name-of-profile: could not load key/certificate'
477924-1	3-Major		System can crash referencing compression provider where selection of provider has been deferred
477394-1	3-Major		LTM might reset and cause out-of-ports
476281	3-Major	K16681	tmm crash on uninitialized variable
475055-3	3-Major		Core caused by incorrect accounting of I/O flows
472944-3	3-Major		SMTPS race condition after STARTTLS may cause incorrect SMTP responses
463902-3	3-Major		Hardware Compression in CaveCreek may cause excessive memory consumption.
437627-5	3-Major		TMM may crash if fastl4 vs has fragmeneted pkt
492780-1	4-Minor	K37345003	Elliptic Curves Extension in ServerHello might cause failed SSL connection.

Application Security Manager Fixes

ID Number	Severity	Solution Article(s)	Description
504232-1	2-Critical		Attack signatures are not blocked after signature/set change
489705-2	2-Critical	K16245	Running out of memory while parsing large XML SOAP requests
478876-2	2-Critical		BIG-IP with many active ASM accounts after a restart
478672-1	2-Critical		Enforcer memory leak
477432-6	2-Critical		Roll forward from 11.3.0 with iApp configured fails to load correctly and causes bd to core★
475856-1	2-Critical		BD may crash when enabling Base64 Decoding on Wildcard cookie
496011-1	3-Major	K17385	Resets when session awareness enabled
492570-1	3-Major		JavaScript error during CSRF protection
481792-1	3-Major	K84202340	BD may crash within HTTP payload parser.
476191-1	3-Major		Bypass unicode validation on XML and JSON profiles by internal parameter
476179-1	3-Major		Brute Force end attack operation mode reported as blocking while it was actually in transparent mode
475861-1	3-Major		Session Awareness: Requests are reset
475135-1	3-Major		BIG-IP goes offline after time change
474430-1	3-Major		Rare issue: client session might not be restored by fingerprint in the Web Scraping mitigation.
473410-1	3-Major		Policy Diff on merging missing URLs
470779-1	3-Major		The Enforcer should exclude session awareness violations when counting illegal requests.
469786-1	3-Major	K04393808	Web Scraping Mitigation: Display of request status when configuration includes an ASM iRule
467776-1	3-Major		Fix in the Guardium to ASM protocol
450241-3	3-Major	K21100172	iControl error when discover ASM from EM
441239-1	3-Major		Event Correlation is not enabled on vCMP guests if the disk is SSD.
438809-6	3-Major	K17098	Brute Force Login

Application Visibility and Reporting Fixes

ID Number	Severity	Solution Article(s)	Description
499299-1	2-Critical		Synchronization problem in AVR lookups sometimes causes TMM and other daemons, such as the Enforcer, to crash
480350-1	2-Critical	K15251065	AVR and APM: TMM crashes
476336	2-Critical		TMM and other daemons, such as the Enforcer, crash
475439-1	2-Critical	K16434	Synchronization problem in AVR lookups sometimes causes TMM and other daemons, such as the Enforcer, to crash
474251-1	2-Critical		IP addresses are not properly cleaned from lookup tables, so there might be no room for new IP addresses to be collected.
472969-1	2-Critical		If you try to create more than 264 AVR profiles, avrd might crash.
499036	3-Major		Rare cases of errors when loading data into mysql
496560-1	3-Major		AVR and APM: TMM crashes (additional fixes for ID 480350)
493825-1	3-Major	K17520	Upgrade failure from version 11.4.0 due to incorrect configuration being saved★
489682-1	3-Major	K40339022	Configuration upgrade failure due to change in an ASM predefined report name★
481541-1	3-Major		Memory leak in monpd when LTM and AVR or ASM are provisioned
478346-1	3-Major		Some AVR statistics not collected properly
472607	3-Major		VCMP: Warning messages in AVR log
467945-3	3-Major		Error messages in AVR monpd log

Access Policy Manager Fixes

ID Number	Severity	Solution Article(s)	Description
488986-2	1-Blocking	K16582	Access policy cannot enter Windows Protected Workspace on Internet Explorer versions 10 and 11, and edge client.
504060	2-Critical		iOS and Mac receivers cannot create account on Citrix StoreFront in proxy mode
494098-6	2-Critical	K16857	PAC file download mechanism race condition
485906	2-Critical		TMM may core when an APM virtual server has a OneConnect profile attached to the virtual server
485465-3	2-Critical	K16775	TMM might restart under certain conditions when executing SLO.
484454-3	2-Critical	K16669	Users not able to log on after failover
482833	2-Critical		apd crash for missing db variable
479524-5	2-Critical	K16823	If a "refresh" response header should not be rewritten, it can crash the rewrite plugin or be improperly rewritten
477540-1	2-Critical	K16851	'ACCESS::policy evaluate' iRule command causes crash of apmd daemon
476736-2	2-Critical		APM IPv6 Network Access connection may fail in some cases
475049-1	2-Critical		Missing validation of disallowing empty DC configuration list
474532-5	2-Critical	K16357	TMM may restart when SLO response is received on SLO request URL (.../post/sls)
474392-1	2-Critical		OS X 10.10 Yosemite support
474058-5	2-Critical	K16689	When the BIG-IP system is configured as Service Provider, APD may restart under certain conditions
471874-1	2-Critical	K16850	VDI plugin crashes when trying to respond to client after client has disconnected
469960-1	2-Critical	K16333	Managing apd connection from tmm
458928-5	2-Critical		APMD cores in Kerberos authentication, when the agent tries to derefence a null authparam session variable.
455284-4	2-Critical	K15907	Monitor traffic rejected with ICMP message, causing node down
496449-1	3-Major		APM does not support using session variables for the destination address in Citrix and VMware View remote desktop resources.
496447-1	3-Major		APM does not apply route domain configured in visual policy editor to Citrix/VMware View connections when their backends are specified as hostname/IP address.
496441-1	3-Major		APM does not apply route domain configured in visual policy editor to Java AppTunnel connections.
496440-1	3-Major		APM does not apply route domain configured in visual policy editor to Java RDP connections.
494284-3	3-Major	K16624	Mac Edge Client, with primary language of German shows unneeded text shown under disconnected status.
494189-1	3-Major		Poor performance in clipboard channel when copying
493487-3	3-Major	K45558362	Function::call() and Function::apply() wrapping does not work as expected
493164-3	3-Major	K62553244	flash.net.NetConnection::connect() has an erroneous security check
492238-6	3-Major	K16848	When logging out of Office 365 TMM may restart
492153-2	3-Major	K17055	Edge clients shuts down the DTLS channel if the state of IP address on the adapter that was used to build the tunnel, changes to deprecated.
491887-1	3-Major	K16645	Changing the ending of a macro in Access Policy crashes TMM.
491478-1	3-Major		EAM is a CMP plugin and spins up one thread per TMM.
491233-1	3-Major	K16105	Rare deadlock in CustomDialer component
490811-5	3-Major		Proxy configuration might not to be restored correctly in some rare cases
490482-1	3-Major	K16638	Applying Access Policy with an unused macro crashes TMM.
488892-3	3-Major		JavaRDP client disconnects
487859-1	3-Major	K42022001	Importing local db users from a CSV file that has no UID set, displays incorrect information in the GUI.
485948-5	3-Major	K17418	Machine Info Agent should have a fallback branch
485396	3-Major		Online help about persistent cookies does not specify supported use
484847-2	3-Major		DTLS cannot be disabled on Edge Client for troubleshooting purposes
484298-2	3-Major	K16605	The aced process may restart in a loop
483601	3-Major	K16895	APM sends a logout Bookmarked Access whitelist URL when session is expired.
483379-1	3-Major		High CPU consumption and unresponsive interface of the menubar icon after 20-30 minutes
482260-4	3-Major		Location of Captive portal configuration registry entry in 64 bit windows is incorrect
482046-1	3-Major		Old password is not verified during password change from View client.
481257-5	3-Major		Information on "OPSWAT Integration Libraries V3" is missing from CTU report
481210-1	3-Major	K16426	Active Directory Query doesn't populate all values of multi-value attributes
481203-5	3-Major		User name case sensitivity issue
481046-5	3-Major	K17497	F5_Inflate_text(o, incr, v) wrapper need to be fixed for case when o is script tag
481020-1	3-Major	K17487	Traffic does not flow through VPN tunnel in environements where proxy server is load balanced
480995-1	3-Major		APM client components are not using extended logging by default.
480247-5	3-Major		Modifying edge client application folder causes gatekeeper to throw warning
480047-1	3-Major		BIG-IP Edge Client for Windows does not enable you to generate a client troubleshooting report from the user interface.
479451-1	3-Major	K16737	Different Outlook users with same password and client IP are tied to a single APM session when using Basic auth
478491	3-Major		Microsoft RDP client for iOS doesn't work against F5 APM for versions >= 8.1.0
478333	3-Major		Edge-Client client shows an error about corrupted config file, when User's profile and temp folders located on different partitions
478285-2	3-Major		[MAC][NA] Routing table is not restored correctly in multi-homed environment if server settings disallow local subnet access
478214-1	3-Major		APM Native RDP Proxy does not allow users to authenticate without specifying a domain name.
478115-5	3-Major		The action attribute value of a form HTML tag is not properly rewritten in the Minimal Content Rewriting mode when it starts with "/"
477841-1	3-Major		Safari 8 does not use Network Access proxy.
477642-5	3-Major		Portal Access rewriting leads to page reload in Firefox
477474-3	3-Major	K03431040	Wrong HTML rewriting at client side for very special case
477445-1	3-Major	K16752	APM client improved to support 2 interface connected to the same network segment
476133-1	3-Major		In APM OAM authentication, ObSSOCookie _lastUseTime was not updated.
476033-1	3-Major		APM does not support Microsoft Remote Desktop 8.0.8 client for iOS to work using APM as RD Gateway.
476032-1	3-Major		BIG-IP Edge Client may hang for sometime when disconnecting from Firepass server
475770-1	3-Major		Fixed routing table management for cases when 2 or more interfaces are used
475682-6	3-Major		APM OAM should be sending a single Cookie header with the cookies delimited by semi-colon.
475650-5	3-Major	K16271	The TMM may restart when processing single logout (SLO) messages.
475363-6	3-Major		Empty or invalid configuration, or during exception in NTLM, handling might not work as expected.
475360-6	3-Major		Edge client remembers specific virtual server URI after it is redirected
475262-1	3-Major		In some cases Edge Client for Windows does not re-resolve server hostname while reconnecting
475163-5	3-Major		Submitting an HTML form that does not have an action attribute is a 404 error and 'null' in the request URL.
475148-1	3-Major		Microsoft RDP Client for Mac OS X ver. 8.0.9 does not work correctly with BIG-IP APM.
475143	3-Major		CATEGORY::filetype command may cause tmm to crash and restart
474730-5	3-Major		Incorrect handling of form if it contains a tag with id=action
474231-5	3-Major		RAM cache evictions spikes with change of access policy which may lead to slow webtop rendering
473728-3	3-Major	K16899	Incorrect HTML form handling.
473386-4	3-Major	K17540	Improved Machine Certificate Checker matching criteria for FQDN case
473344-6	3-Major		Kerberos Request-Based Auth (RBA) failure when session is initially created on a different VIP.
472825-2	3-Major	K52892802	The Dashboard charts may dip when a blade is rebooted.
471825-3	3-Major	K16637	Add 'Date:' header in email message generated by APM Email agent to comply with RFC 5322.
471772-1	3-Major		APM does not support VMware View application remoting.
471714-1	3-Major	K16637	Certain SMTP servers (Windows) do not receive complete email due to missing CRLF header terminator in Emails generated by APM Email agent.
471125	3-Major		Fixed issue causing EdgeClient to work improperly behind environment with CaptivePortal.
470414-4	3-Major		Portal Access rewrite daemon may crash while processing some Flash files
470225-4	3-Major	K15951	Machine Certificate checker now correctly works in Internet Explorer 11
470205-2	3-Major		/config/.../policy_sync_d Directory Is 100% Full
469100-5	3-Major	K17145	JavaScript index expressions with a comma are not properly rewritten
468478-5	3-Major	K16659	APM Portal Access becomes unresponsive.
467849-6	3-Major		In some cases user cannot go to external sites through proxy when vpn is connected
466877-6	3-Major		When BIG-IP is used as SAML SP, signatures created by IBM Tivoli Federated Identity Manager may fail validation
466325-6	3-Major	K16692	Continuous policy checks on windows might fail incorrectly in some cases
463776-2	3-Major	K17142	VMware View client freezes when APM PCoIP is used and user authentication fails against VCS 5.3
463230-1	3-Major		Aced service does not recover if child process dies.
462727-1	3-Major	K16436	TMM crash when processing ACCESS::session iRule without an attached Access Policy
456403-2	3-Major		Citrix Storefront native protocol
454493-1	3-Major	K16566	VMWare View applications are not available on BIG-IP APM webtops
447013-4	3-Major	K15890619	The Citrix Client Detection process may incorrectly prompt for the installation of client software.
441355-1	3-Major		Enable change password within vmview client when password doesn't meet the AD policy requirements
439518-3	3-Major	K16254	Portal access resource item modifications are not synced
438730-5	3-Major	K16666	DNS Filtering driver causes crash/BSOD
432102-6	3-Major		HTML reserved characters not supported as part of SAML RelayState
431810-5	3-Major	K16315	APMD process core due to missing exception handling in execute agents
428387-2	3-Major		SAML SSO could fail if SAML configuration contains special XML characters (&,<,>,",')
418850-1	3-Major		Do not restrict AD to be the last auth agent for View Client
407350-4	3-Major		Client side checks on Windows Phone 8
400726-4	3-Major		No support for multi-valued attributes inside SAML assertion.
398657-8	3-Major		Active Session Count graph underflow
503924-1	4-Minor		Citrix receivers cannot authenticate
492844-1	4-Minor		Office365 generated SAML SLO message causes browser connection to be reset.
489888-1	4-Minor		Configuring VDI profile when APM is not provisioned, but does not.
489364-1	4-Minor		Now web VPN client correctly minimizes IE window to tray
485760-1	4-Minor		Tag <NameIDFormat> in SAML metadata may contain wrong attributes
480827-1	4-Minor		Logging might show unnecessary messages when Citrix Receiver connects to Storefront: err tmm[20105]: 01490563:3: 00000000: Access stats encountered error: Failed to add/delete session entry (ERR_NOT_FOUND).
480360-5	4-Minor		Edge Client for Mac blocks textexpander application's functionality
478397-1	4-Minor		Memory leak in BIG-IP APM Edge Client Windows API.
477138-1	4-Minor		Only one of several VMware View Desktop/Application pools with the same display name can be launched from APM Webtop
473377-5	4-Minor		BIG-IP as IdP may rejects AuthnRequest with specific NameID format
472216-2	4-Minor		Duration counter for customized Edge Client
466797-6	4-Minor		Added warning message when maximum session timeout is reached
464547-1	4-Minor		Show proper error message when VMware View client sends invalid credentials to APM
450033-5	4-Minor		Sometimes VMware View client 2.3 for Windows can't launch desktops via APM
447302-3	4-Minor		APM incorrectly supports 'redirect' ending in an access policy for web browser clients when deployed for Citrix Web Interface in proxy mode.
432423-5	4-Minor		Need proactive alerts for APM license usage
421901-2	4-Minor		The 'Restore down' button can be hidden for full-screen RDP resources.
503673-1	5-Cosmetic		APM sets MRHSession cookie on /cgi/login request from Citrix Receivers
486344-2	5-Cosmetic		French translation does not properly fit buttons in BIG-IP Edge client on Windows
484856-1	5-Cosmetic		Citrix remote desktop visible even if the user cannot access it

Wan Optimization Manager Fixes

ID Number	Severity	Solution Article(s)	Description
479889-5	1-Blocking		Memory leaks when iSession and iControl are configured
480305-1	4-Minor		tmm log flood: isession_handle_evt: bad transition:7

Service Provider Fixes

ID Number	Severity	Solution Article(s)	Description
476886-3	3-Major	K15727	When ICAP cuts off request payload, OneConnect does not drop the connection
472092-3	3-Major		ICAP loses payload at start of request in response to long execution time of iRule

Advanced Firewall Manager Fixes

ID Number	Severity	Solution Article(s)	Description
496036	1-Blocking	K16640	GUI throws an error in some situations when an ASM policy is assigned to virtual server
484245-1	1-Blocking		Delete firewall rule in GUI changes port settings in other rules to 'any'
498227-2	2-Critical		Incorrect AFM firewall rule counter update after pktclass-daemon restarts.
497342	2-Critical		TMM crash while executing FLOW_INIT event (with multiple commands that abort the connection) in an iRule attached to an AFM firewall rule.
480903-1	2-Critical		AFM DoS ICMP sweep mitigation performance impact
478644	2-Critical		dwbld race with mcpd causes core.
477769-1	2-Critical		TMM crash (panic) in AFM pktclass code (Assertion 'classifier ref non-zero' failed.) when virtual server has SPDY or HTTP Prefetching enabled along with AFM Rules.
469512-2	2-Critical		TMM aborted by SOD due to heartbeat failure when trying to load huge firewall policies.
500640-1	3-Major		TMM core could be seen if FLOW_INIT iRule attached to Virtual server
497732-2	3-Major		Enabling specific logging may trigger other unrelated events to be logged.
497667-2	3-Major		Configuring of ICMPv4/ICMPv6 ip-protocol in mgmt port ACL Rules generated error
497263-1	3-Major		Global whitelist count exhausted prematurely
496498-3	3-Major		Firewall rule compilation will fail in certain scenario when there are multiple scheduled AFM rules and one of the non scheduled AFM rule is modified.
495928-5	3-Major		APM RDP connection gets dropped on AFM firewall policy change
495698-3	3-Major		iRule can be deleted even though it exists in a rule-list
493234-1	3-Major		Device version in AFM log message could be empty
485787-1	3-Major		Firewall ACL counters for staged policy attached to a Virtual/SelfIP are not incremented when a policy with a similar rule to drop/reject packets is enforced by the Global or Route Domain context
485771-1	3-Major		TMM crashes while executing multiple FLOW_INIT events and one of the event triggers an abort.
480826	3-Major		IPs can be added for infinite duration
478816	3-Major		Fastl4 TCP connection trasitions are not logged
477576-1	3-Major		Valid iRule command FLOWTABLE::limit gets rejected when virtual server or route domain name is not specified
474896-1	3-Major	K10035412	Remote logs without attack ID and mitigation fields
442535-5	3-Major	K16227	Time zone changes do not apply to log timestamps without tmm restart
429885-6	3-Major	K17576	Traffic that does not match any virtual or Self IP is dropped silently (without any logs or statistics)
498785	4-Minor		Black List Classes/Black List Categories terminology inconsistency
481189-2	4-Minor		Change the default value of pccd.hash.load.factor to 25
480623	4-Minor		Category defaulted to whitelist when a valid category was not specified
480196	4-Minor		Packets not counted in tmctl ip_intelligence_stat on accept-decisively ACL match
478631	4-Minor		No validation for Shun TTL lengths

Policy Enforcement Manager Fixes

ID Number	Severity	Solution Article(s)	Description
489754-1	2-Critical	K17408	Flow based reporting attribute mismatch between TMUI and TCL
483798-1	2-Critical		TMM crashes if iRule PSC::ip_address is used after RADIUS Authentication of DHCP discovery.
481373-1	2-Critical		TMM might core when deleting an entry for a user in a Radius AAA cache
472860-3	2-Critical		RADIUS session statistics for the subscribers created with an iRule running on the RADIUS virtual server are not incremented.
484095-1	3-Major		RADIUS accounting message with multiple IPv6 prefix causes TMM crash
482137-1	3-Major		Adding TCP iRules to PEM space
479917-1	3-Major		TMM crashes if new IP address is added to a session through radius interim update message.
476705-1	3-Major		TMM can crash if receiving radius start or stop messages with multiple IP but no subscriber ID.
474638-1	3-Major		PEM: Session policy list may be lost if there is an radius update of custom attributes
453959-3	3-Major		UDP profile improvement for flexible TTL handling
481950-1	4-Minor		DHCP: Need an upgrade script for DHCPRELAY virtuals for BIG-IP version 11.5 and 11.4★
476904-2	4-Minor		App type 0 session Update Failed on PEMDB: ERR_INPROGRESS

Fraud Protection Services Fixes

ID Number	Severity	Solution Article(s)	Description
484020	2-Critical		If Identify as Username is enabled for a parameter, the Encrypt checkbox is not grayed out.
492549	3-Major		FPS injection only into success responses
489933	3-Major		Generic malware false positives
486001	3-Major		Application Layer encryption not working on password field in certain situations
485253	3-Major		Enable directory protection
482034	3-Major		Browser displays error in console in Firefox 3.6.22
474469	3-Major		Identical source integrity alerts are present.
473771	3-Major		No URL path in the Browser Automation alert
491168	4-Minor		Encrypt checkbox should be greyed out for a new parameter when Application Layer Encryption is disabled under URL Configuration.
478859	4-Minor		Username displayed with trailing "&" sign

Global Traffic Manager (DNS) Fixes

ID Number	Severity	Solution Article(s)	Description
482442-5	4-Minor		[GTM] [GUI] Changes to a single wideip Propagates to All WIPs

Traffic Classification Engine Fixes

ID Number	Severity	Solution Article(s)	Description
487512-1	2-Critical		Enable Bittorrent classification in Qosmos by default
479450	2-Critical	K16766	SSL traffic is not forwarded to destination

Cumulative fixes from BIG-IP v11.6.0 Hotfix 3 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
484635-1	CVE-2014-3513 CVE-2014-3567 CVE-2014-3566 CVE-2014-3568	K15722	OpenSSL DTLS SRTP Memory Leak CVE-2014-3513, OpenSSL vulnerability CVE-2014-3567, and OpenSSL vulnerability CVE-2014-3568.
451218-2	CVE-2014-8730	K15882	TLS1.x padding vulnerability CVE-2014-8730.

Functional Change Fixes

None


TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
478791-1	1-Blocking		Hardware compression test fails on 5000 series, 7000 series, 10000 series platforms

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
488208-1	2-Critical		openssl v1.0.1j.
485188-1	3-Major		Support for TLS_FALLBACK_SCSV

Global Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
487808-3	3-Major		End of Life announcement for inbound and outbound cost-based link load balancing and inbound link path-based load balancing.

Cumulative fixes from BIG-IP v11.6.0 Hotfix 2 that are included in this release


Functional Change Fixes

None


TMOS Fixes

ID Number	Severity	Solution Article(s)	Description
476475	1-Blocking		SSL accelerator card does not function on the BIG-IP 12250 platform.
479374-5	2-Critical	K16255	Setting appropriate TX driver settings for 40 GB interfaces.
478948	2-Critical		DC PSU reported as AC
477676	2-Critical		HSB v2.3.12.1 bitstream integrated to fix HSB firmware issues
473772	3-Major		SNMP reports the incorrect product name for the BIG-IP 10350 NEBS platform.
473210	3-Major		Chassis Temperature Status not showing Nitrox3x3 temperatures
472767-1	3-Major		Adding slots to running guests with host-iso can become stuck
467693-1	3-Major	K16664	sysObjectID SNMP OID returns 'linux' instead of BIG-IP platform.
410101-3	3-Major		HSBe2 falls off the PCI bus

Local Traffic Manager Fixes

ID Number	Severity	Solution Article(s)	Description
477571-1	2-Critical		HTTP/2 support.

Cumulative fixes from BIG-IP v11.6.0 Hotfix 1 that are included in this release


Vulnerability Fixes

ID Number	CVE	Solution Article(s)	Description
480931-1	CVE-2014-6271 CVE-2014-7169 CVE-2014-7187 CVE-2014-7186 CVE-2014-6277 CVE-2014-6278	K15629	Multiple BASH vulnerabilities - ShellShock

Functional Change Fixes

None

Cumulative fix details for BIG-IP v11.6.2 that are included in this release

684879-3 : Malformed TLS1.2 records may result in TMM segmentation fault.

Component: Local Traffic Manager

Symptoms:
TMM receives a malformed TLS1.2 record.

Impact:
TMM produces a core file and takes the configured HA failover action.

Workaround:
No workaround.

---

679235-4 : Inspection Host NPAPI Plugin for Safari can not be installed

Component: Access Policy Manager

Symptoms:
Inspection Host NPAPI Plugin for Safari on macOS High Sierra can not be installed.

Conditions:
macOS High Sierra, Inspection Host Plugin package installation triggered.

Impact:
Inspection Host plugin cannot be installed, therefore, endpoint checks will not work.

Workaround:
There is no workaround at this time.

Fix:
Inspection Host NPAPI Plugin for Safari can now be installed successfully.

---

676300-6 : EPSEC binaries may fail to upgrade in some cases★

Solution Article: K04551025

Component: Access Policy Manager

Symptoms:
Windows client may fail to upgrade endpoint security package in some cases. This happens due to a corrupted registration of old endpoint security components.

Conditions:
Corrupted registry entry related to endpoint security components.

Impact:
Client may not be able to upgrade to latest endpoint package hosted on APM.

Workaround:
Remove the following registry keys from the registry:

Note: Use extra care editing the registry. Only remove the following keys, and no others.


"HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_CLASSES_ROOT\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_CLASSES_ROOT\Wow6432Node\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_CLASSES_ROOT\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"
"HKEY_CLASSES_ROOT\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"


"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"


"HKCU\SOFTWARE\Classes\Wow6432Node\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKCU\SOFTWARE\Classes\CLSID\{2C8FFA64-E3F7-49AE-87C2-49018FDE3AEA}"
"HKCU\SOFTWARE\Classes\Wow6432Node\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKCU\SOFTWARE\Classes\Interface\{C0A8E51C-D6A5-4BF6-8926-CAF99DE30466}"
"HKCU\SOFTWARE\Classes\Wow6432Node\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"
"HKCU\SOFTWARE\Classes\TypeLib\{1864D368-D26C-4393-A64E-C9910B7E08AE}"

Fix:
EPSEC binaries now upgrade successfully.

---

667278-4 : DSC connections between BIG-IP units may fail to establish

Component: TMOS

Symptoms:
The device service clustering (DSC) connection between two BIG-IP units may fail to establish. One unit will log messages similar to the following example:

-- err mcpd[7912]: 01071af4:3: Inbound CMI connection from IP (192.168.100.1) denied because it came from VLAN (v1542), not from expected VLAN (tmm).

While the unit at the other end of the connection will log messages similar to the following example:

-- notice mcpd[5730]: 01071432:5: CMI peer connection established to 192.168.200.1 port 6699 after 0 retries
May 31 20:58:04 BIG-IP-c-sea notice mcpd[5730]: 0107143c:5: Connection to CMI peer 192.168.200.1 has been removed

Conditions:
This issue occurs when the Self-IP addresses used for Config-Sync by the two BIG-IP units are not in the same IP subnet, and special routing is configured between the BIG-IP units. Examples of special routing include a gateway pool or dynamic routing configurations with multiple routes to the same destination (i.e., ECMP routing).

Impact:
Config-Sync and device discovery operations will fail between affected units.

Workaround:
You can work around this issue by using Self-IP addresses for Config-Sync that are on the same IP subnet or rely on simpler routing to achieve connectivity (i.e., a single route).

Fix:
Config-Sync and device discovery operations no longer fail.

---

665905-1 : Signature System corruption from specific ASU prevents ASU load after upgrade

Solution Article: K83305000

Component: Application Security Manager

Symptoms:
After loading Attack Signature Update "ASM-SignatureFile_20170403_145743.im" on 11.5.4 HF2 (or later) and upgrading to certain software versions, attempts to perform Signature Update fail.

Conditions:
-- Loading Attack Signature Update "ASM-SignatureFile_20170403_145743.im".
-- Using v11.5.4 HF2 (or later).
-- Upgrading the device to 11.6.1, 12.1.0, 12.1.1, or 12.1.2.

Impact:
Attempts to perform Signature Update fail.

Workaround:
The mistaken Signature System can be deleted using the following SQL:

----------------------------------------------------------------------
UPDATE PLC.NEGSIG_SIGNATURE_SYSTEMS set system_id = 14 where system_id = (select system_id FROM PLC.NEGSIG_SYSTEMS where system_name = 'Apache');
DELETE FROM PLC.NEGSIG_SYSTEMS where system_name = 'Apache';
----------------------------------------------------------------------

Fix:
Database corruption introduced by loading Attack Signature Update 'ASM-SignatureFile_20170403_145743.im' is now corrected upon upgrade.

---

664930-1 : Policy automatic learning mode changes to manual after failover

Component: Application Security Manager

Symptoms:
Policy automatic learning mode changes to manual when a failover occurs.

Conditions:
-- ASM provisioned.
-- Device group with ASM policy sync configured for multi-blade devices.
-- ASM Policy is in automatic learning mode.
-- A failover occurs.

Impact:
The policy changes from automatic learning mode to manual.

Workaround:
None.

Fix:
Policy automatic learning mode no longer changes to manual when a failover occurs. Automatic learning mode will now be disabled only in active/active configurations.

---

663326-3 : Thales HSM: "fipskey.nethsm --export" fails to make stub keys

Component: Local Traffic Manager

Symptoms:
When using "fipskey.nethsm --export -i /shared/tmp/testkey.pem -o thaleskey" to export a key file from BIG-IP and import into HSM, the HSM fails to generate the stub key at /config/ssl/ssl.key/ on the BIG-IP system.

Conditions:
-- Thales HSM is installed.
-- Running 'fipskey.nethsm --export' to export a key file from BIG-IP and import it to the Thales HSM.

Impact:
Even the key has been stored in HSM, the BIG-IP is still unable to use it because of its lacking stub key to be configured on the BIG-IP system.

Workaround:
This can be worked around by directly using the Thales command, for example:

[root@localhost:Active:Standalone] config # generatekey --import pkcs11 certreq=yes
type: Key type? (DES3, RSA, DES2) [RSA] >
pemreadfile: PEM file containing RSA key? []
> /shared/tmp/testkey.pem
embedsavefile: Filename to write key to? []
> /config/ssl/ssl.key/thales2
plainname: Key name? [] > thales2
x509country: Country code? [] > US
x509province: State or province? [] > WA
x509locality: City or locality? [] >
x509org: Organisation? [] > F5
x509orgunit: Organisation unit? [] > AS
x509dnscommon: Domain name? [] >
x509email: Email address? [] > test@test.com
nvram: Blob in NVRAM (needs ACS)? (yes/no) [no] >
digest: Digest to sign cert req with? (md5, sha1, sha256, sha384, sha512)
  [default sha1] >

Fix:
When using 'fipskey.nethsm --export -i /shared/tmp/testkey.pem -o thaleskey' to export a key file from BIG-IP and import into HSM, the HSM now generates a stub key and stores it at /config/ssl/ssl.key/ on the BIG-IP system, as expected.

---

658852-1 : Empty User-Agent in iSessions requests from APM client on Windows

Component: Access Policy Manager

Symptoms:
'User-Agent' might be empty in some '/isession' requests from APM client on Microsoft Windows. Having empty User-Agent headers is not in RFC compliance and forces some firewall to block the connection. This might result in failure to establish a VPN tunnel.

Conditions:
'/isession' requests from APM client on Windows.

Impact:
Failure to establish a VPN tunnel.

Workaround:
None.

Fix:
All connections from APM client now contain 'User-Agent:' strings, as expected.

---

655691-1 : GUI image list contains misleading 'MD5 Sum Verified' field

Component: TMOS

Symptoms:
In the GUI, images in the Image List and Hotfix List contain a field called 'MD5 Sum Verified', which is misleading since no such verification is actually done.

Conditions:
Using BIG-IP GUI and viewing the Image List and Hotfix List.

Impact:
It appears that MD5 sums are being verified when in reality much more limited tests are done.

Workaround:
N/A

Fix:
Replace 'MD5 Sum Verified' with 'BIG-IP Image Verified' in Image List and Hotfix List in BIG-IP GUI to more accurately reflect our verification procedures.

---

655059-2 : TMM Crash

Component: TMOS

Symptoms:
Undisclosed conditions may cause TMM to crash

Conditions:
Undisclosed

Impact:
TMM crash, leading to HA failover

Fix:
Improve TMM reliability

---

655021-3 : BIND vulnerability CVE-2017-3138

Solution Article: K23598445

---

654566-1 : Incomplete files still linked in /shared/vmisolinks

Solution Article: K94822416

Component: TMOS

Symptoms:
If copying of an image file is interrupted and leaves a partial file with a .part or .filepart extension, it is still linked in /shared/vmisolinks and synced between blades.

Conditions:
Copy of an image to /shared/images is interrupted and a file with a .part or .filepart extension is left behind.

Impact:
The corrupted copy might appear valid when it is not.

Workaround:
Delete incomplete file copies with extension .part or .filepart.

Fix:
Csyncd ignores files with extensions .part or .filepart in /shared/images.

---

654109-3 : Configuration loading may fail when iRules calling procs in other iRules are deleted

Solution Article: K01102467

Component: Local Traffic Manager

Symptoms:
Loading of the configuration fail with a message indicating a previously deleted iRule cannot be found:

 01020036:3: The requested rule (/Common/rule_uses_procs) was not found.

Conditions:
- iRule A is calling another iRule B using proc calls
- iRule A is attached to a virtual server.
- Detaching and deleting iRule A.
- Loading the config (or performing config sync).

Impact:
iRules are still referenced after implicit deletion (via load).
Configuration does not load.

Workaround:
Force reloading of the MCP binary database.

For specific steps, see K13030: Forcing the mcpd process to reload the BIG-IP configuration (https://support.f5.com/csp/article/K13030).

Fix:
Configuration loading no longer fails when iRules calling procs in other iRules are deleted.

---

653993-2 : A specific sequence of packets to the HA listener may cause tmm to produce a core file

Component: Local Traffic Manager

Symptoms:
A specific sequence of packets to the HA listener may cause tmm to produce a core file.

Conditions:
The BIG-IP is configured for HA.

Impact:
The TMM process may restart and produce a core file.

---

653880-1 : Kernel Vulnerability: CVE-2017-6214

Solution Article: K81211720

---

652516-1 : Multiple Linux Kernel Vulnerabilities

Solution Article: K31603170

---

652400-1 : During blade changes, PBA may cause a TMM restart

Component: Carrier-Grade NAT

Symptoms:
TMM will restart, and an ASSERT will appear in the logs that there have been too many retries.

Conditions:
-- A port block allocation configuration with very high CPU utilization.
-- The addition of a new blade.
-- Running a version earlier than 12.0.0.

Impact:
TMM will restart, so existing blocks and connections will be lost. Traffic disrupted while tmm restarts.

Workaround:
There is no workaround.

---

650002-3 : tzdata bug fix and enhancement update

Component: TMOS

Symptoms:
There have been changes to timezone data that impact tzdata packages:

* Mongolia no longer observes Daylight Saving Time (DST).

* The Magallanes Region of Chile has moved from a UTC-04/-03 scheme to UTC-03 all year. Starting 2017-05-13 at 23:00, the clocks for the Magallanes Region will differ from America/Santiago.

Conditions:
-- Mongolia during DST portion of the year.
-- Comparing clock times in the America/Santiago zone with those in the Magallanes Region.

Impact:
Timezone data provided in tzdata will not match the area's time. Clocks for the Magallanes Region will differ from America/Santiago (its current timezone).

Workaround:
None.

Fix:
To accommodate for Mongolia no longer observing DST, the new America/Punta_Arenas zone was created. Changes were also made to support other timezone changes.

* The zone1970.tab file has been added to the list of files to be installed with the tzdata packages installation.

Note: Users of tzdata are advised to upgrade tzdata to zdata-2017b-1.el6

---

649933-3 : Fragmented RADIUS messages may be dropped

Component: Service Provider

Symptoms:
Large RADIUS messages may be dropped when processed by iRules.

Conditions:
This occurs when a RADIUS message that exceeds 2048 bytes is processed by an iRule containing the RADIUS::avp command.

Impact:
The RADIUS message will be dropped, and an error will be logged that resembles:

Illegal argument (line 1) (line 1) invoked from within "RADIUS::avp 61 "integer""

Workaround:
Remove RADIUS::avp commands from iRules processing large messages, or ensure that no RADIUS client or server will send large messages.

---

649907-3 : BIND vulnerability CVE-2017-3137

Solution Article: K30164784

---

649904-3 : BIND vulnerability CVE-2017-3136

Solution Article: K23598445

---

649613-1 : Multiple UDP/TCP packets packed into one DTLS Record

Component: Access Policy Manager

Symptoms:
The system converts the server provided packet into PPP buffers. These PPP packets are used to pack into DTLS records. Currently there is a limit of about 14 KB of DTLS records, such that the system can pack multiple PPP records into one DTLS record.

However, creating bigger DTLS record can cause server IP Fragmentation. In the lossy environment, losing one IP fragment can cause the complete DTLS record to be lost, resulting in poor performance.

Conditions:
Multiple UDP/TCP packets packed into one DTLS Record.

Impact:
In networks with packet losses, the APM end-user application might suffer poor network performance.

Workaround:
None.

Fix:
The system packs one PPP record into one DTLS record, which reduces / eliminates IP Fragmentation and prevents poor performance.

---

648954-3 : Configuration validation (e.g., ConfigSync) may fail after an iRule is deleted, if the iRule made procedure calls

Solution Article: K01102467

Component: Local Traffic Manager

Symptoms:
Configuration validation fails spuriously, including potentially as a result of a ConfigSync or modifying an iRule, with an error similar to the following:

    01020036:3: The requested rule (/Common/rule_uses_procs) was not found.

Referencing an iRule that previously existed, but has been deleted (or is being deleted as a result of a ConfigSync).

Conditions:
-- iRule using procedures in a different iRule.
-- iRule attached to virtual server.

Impact:
iRule procs are still referenced after deletion. Configuration validation fails spuriously.

Workaround:
Force reloading of the MCP binary database.

For specific steps, see K13030: Forcing the mcpd process to reload the BIG-IP configuration (https://support.f5.com/csp/article/K13030).

---

648879-1 : Linux kernel vulnerabilities: CVE-2016-6136 CVE-2016-9555

Solution Article: K90803619

---

648865-1 : Linux kernel vulnerability: CVE-2017-6074

Solution Article: K82508682

---

648316 : Flows using DEFLATE decompresion can generate error message during flow tear-down.

Component: TMOS

Symptoms:
Repeated entries in the ltm log will show a completion-code error (comp_code=4) as in the following:

  Zip engine ctx eviction (comp_code=4): ctx dropped.

Conditions:
The problem occurs when a flow that requests DEFLATE decompression is terminated when the compression engine is still in the middle of working on an incomplete DEFLATE block.

Impact:
False errors can appear:
  o In fields of tmctl rst_cause_stat table, false stats counters will increment for compression and packet errors.
  o Log entries with the "Zip engine... (comp_code=4)" appear in ltm log.

Monitors observing the ltm log or stats in the tmctl rst_cause_stat table will see false positives.

Workaround:
Disable hardware acceleration.

Fix:
A new tcl variable, nitrox::comp_suppress_itrunc, was added. It defaults to NO which yields legacy behavior. Setting it to YES causes comp_code=4 (ITRUNC) errors to not propagate as an error.

To enable the feature, add the following line to /config/tmm_init.tcl:

    nitrox::comp_suppress_itrunc yes

You will have to restart tmm for the change to take effect.

---

647944-3 : MCP may crash when making specific changes to a FIX profile attached to more than one virtual server

Component: TMOS

Symptoms:
When a FIX profile is attached to more than one virtual server, making specific edits to the profile may result in MCP crashing and restarting.

Conditions:
A FIX profile is be in use and attached to more than one virtual server. You then edit the profile (and click "Update") in this order:

- Change the Error Action from "Don't Forward" to "Drop Connection"
- Add a new mapping to the Sender and Tag Substitution Data Group Mapping.

Impact:
Traffic disrupted while mcpd restarts.

Fix:
Prevented MCP from crashing when the FIX profile is edited.

---

646604-3 : Client connection may hang when NTLM and OneConnect profiles used together

Solution Article: K21005334

Component: Local Traffic Manager

Symptoms:
In deployments where a NT LanManager (NTLM) authentication profile and a OneConnect profile are used together in a LTM virtual server to label an authenticated connection to a Domain Controller (DC); if the persisted connection to the DC is re-used, the connection may hang. A connection in this state may not be cleaned up by the sweeper, resulting in a memory leak.

Conditions:
The NTLM and OneConnect profiles are associated with a LTM virtual server.

Impact:
A client connection won't be serviced and TMM memory will leak. Over a long time period, this may result in more widespread service disruptions.

Workaround:
Avoid the use of OneConnect profiles on virtual servers that use NTLM profiles. The connections to the Domain Controller won't be pooled, but all other features will be retained.

Fix:
Fixed a problem that prevented NTLM and OneConnect profiles from working properly on the same LTM virtual server.

---

645684-1 : Flash application components are loaded into wrong ApplicationDomain after Portal Access rewriting.

Component: Access Policy Manager

Symptoms:
Flash ActionScript3 application components are loaded into incorrect ApplicationDomain and in some rare cases this may cause errors in application.

Conditions:
This can occur when viewing Flash video while connected to APM.

Impact:
Flash applications might fail to render through Portal Access.

Workaround:
None

Fix:
Flash files accessed through Portal Access are now loading components into correct Application Domain

---

645179-3 : Traffic group becomes active on more than one BIG-IP after a long uptime

Solution Article: K42751321

Component: TMOS

Symptoms:
Traffic-groups become active/active for 30 seconds after a long uptime interval.

Note: Uptime required to encounter this issue is dependent on the number of traffic groups: the more traffic groups, the shorter the uptime.

For example:

-- For 7 traffic groups, the interval is ~710 days.
-- For 15 traffic groups, the interval is ~331 days.

Conditions:
-- Two or more BIG-IP systems defined in a device group for sync/failover.
-- There is one or more traffic groups configured.
-- The BIG-IP systems have a long uptime.

Impact:
Outage due to traffic-group members being active on both systems at the same time.

Workaround:
There is no workaround.

The only option is to reboot all the BIG-IP units in the device group on a regular interval. The interval is directly dependent on the number of traffic groups.

Fix:
Traffic groups no longer becomes active on more than one BIG-IP system in a device group after a long uptime interval.

---

645101-4 : OpenSSL vulnerability CVE-2017-3732

Solution Article: K44512851

---

644970-2 : Editing a virtual server config loses SSL encryption on iSession connections

Component: Wan Optimization Manager

Symptoms:
Editing a virtual server configuration causes iSession connection resets or unencrypted iSession connections to be established, because the virtual server's dynamically configured default server-ssl profile has been deleted.

Conditions:
A virtual server has a server-side iSession profile with data-encrypt enabled. This virtual server also lacks client-ssl and server-ssl profiles.

Impact:
After editing the virtual server, iSession connections fail to be established if the destination iSession listener has a client-ssl profile with allow-non-ssl disabled. If the destination iSession listener has allow-non-ssl enabled, unencrypted iSession connections are established.

Workaround:
Modify the virtual server's configured server-side iSession profile. For example toggle the iSession profile from A to B and then back to A.

Fix:
Editing a virtual server configuration no longer deletes
an iSession dynamically configured default server-ssl profile.

---

644904-4 : tcpdump 4.9

Solution Article: K55129614

---

644693-4 : Fix for multiple CVE for openjdk-1.7.0

Solution Article: K15518610

---

644489-2 : Unencrypted iSession connection established even though data-encrypt configured in profile

Solution Article: K14899014

Component: Wan Optimization Manager

Symptoms:
iSession connections may be intermittently established as unencrypted even though they are configured to be secure.

Conditions:
Either of two scenarios can result in an unencrypted iSession connection being established:
    1) An error occurs during dynamic server-ssl profile replacement.
    2) Both the WOM local-endpoint and destination WOM remote-endpoint lack server-ssl profiles.

In both cases the virtual server must have a server-side iSession profile with data-encrypt enabled and the remote virtual must have a client-ssl profile with allow-non-ssl enabled.

Impact:
An unencrypted iSession connection may be established which is inconsistent with configuring data-encrypt as enabled in the sever-side iSession profile.

Workaround:
Configure the client-ssl profile with allow-non-ssl disabled (the default value) to reject non-SSL connections.

Fix:
The outgoing connection is aborted if the server-side iSession profile is configured with data-encrypt enabled and either of the two following scenarios occurs:
    1) The destination remote-endpoint and the local-endpoint lack server-ssl profiles.
    2) An error occurs during dynamic server-ssl profile replacement.

---

644220-2 : Flawed logic when retrieving an LTM Virtual Server's assigned Link on the LTM Virtual Server Properties page

Solution Article: K37049259

Component: Global Traffic Manager (DNS)

Symptoms:
Under LTM :: Virtual Servers :: Properties, the "Link" value sometimes displays "none" when it should display an actual link name.

Conditions:
This happens under certain configuration of Self IP / GTM Servers / GTM Links / LTM Virtual Servers.

Impact:
When conditions are met, the Virtual Server's link information displayed is not correct.

Workaround:
None.

Fix:
Virtual Server's assigned Link on the LTM Virtual Server Properties page is now displayed correctly.

---

644184-1 : ZebOS daemons hang while AgentX SNMP daemon is waiting.

Solution Article: K36427438

Component: TMOS

Symptoms:
ZebOS daemons hang while AgentX SNMP daemon is waiting for return from external script.

Conditions:
- Dynamic routing is enabled.
- SNMP is enabled.
- SNMP calls an external script that takes several moments to return.

Impact:
Dynamic routing may be halted for the duration of AgentX daemon waiting for return from external script.

Workaround:
Do not configure AgentX to call external scripts that take several moments to return.

Fix:
ZebOS daemons no longer hangs while AgentX is waiting.

---

643582-1 : Config load with large ssl profile configuration may cause tmm restart

Component: Local Traffic Manager

Symptoms:
When doing a config load with a large number of ssl profiles tmm may become busy enough to cause mcp tcp connection to go down and cause tmm restart.

Conditions:
Doing a full config load with large number of ssl profiles.

Impact:
Possible tmm restart.

Workaround:
Doing incremental sync of changes can avoid this issue.

Fix:
A full configuration reload with large number of ssl profiles may cause tmm restart.

---

643210-1 : Restarting MCPD on Secondary Slot of Chassis causes deletion of netHSM keys on SafeNet HSM

Solution Article: K45444280

Component: Local Traffic Manager

Symptoms:
When mcpd (re)starts on a secondary slot, part of the initialization process triggers the delete of any netHSM keys on the SafeNet HSM.

Conditions:
This occurs on a chassis that is configured to use a SafeNet netHSM.

Impact:
The key is removed from the HSM and must be reimported to the HSM from a backup, if it exists.

Workaround:
When rebooting a secondary blade, temporarily remove the BIG-IP from the network it uses to connect to the SafeNet HSM. Once the BIG-IP is Active, it is safe to reconnect it to the network.

Fix:
The BIG-IP no longer deletes keys from the Safenet HSM when the key is deleted from the BIG-IP system. Now, you must manually delete keys using fipskey.nethsm or 'cmu delete'.

Important! Delete operations cannot be undone. Before deleting keys on the HSM using one of these commands, make sure that the key is not used by any BIG-IP, because the key deletion on the HSM is irreversible.

Behavior Change:
Beginning with this release, the BIG-IP system will not delete a key from the SafeNet HSM when you delete the corresponding key on the BIG-IP system: You must manually delete the key on the HSM using either fipskey.nethsm or 'cmu delete'.

Important! Delete operations cannot be undone. Before deleting keys on the HSM using one of these commands, make sure that the key is not used by any BIG-IP, because the key deletion on the HSM is irreversible.

---

643187-3 : BIND vulnerability CVE-2017-3135

Solution Article: K80533167

---

642400-1 : Path MTU discovery occasionally fails

Component: Local Traffic Manager

Symptoms:
Connections using a TCP profile that receive an ICMP needsfrag message may incorrectly ignore the message. This may cause Path MTU discovery to fail.

Conditions:
TCP profile assigned to VIP. Smaller MTU on data path than on TCP endpoints.

Impact:
The connection may stall as large TCP segments are continually retransmitted.

Workaround:
Configure the MSS in the TCP profile to match the lowest MSS. Use or disable Path MTU discovery with the tm.pathmtudiscovery database key.

Fix:
Path MTU discovery functions correctly with the TCP profile.

---

641360-3 : SOCKS proxy protocol error

Solution Article: K30201296

---

640768-1 : Kernel vulnerability: CVE-2016-10088

Solution Article: K05513373

---

639617 : When AVR collect Page load time and/or session data the Content-Length can be set incorrectly

Component: Application Visibility and Reporting

Symptoms:
When the analytics profile with 'Page Load Time' and 'User Sessions' options is attached to a virtual server, sometimes it can incorrectly modify Content-Length for HTML responses. This might happen due to memory corruption.

Conditions:
AVR collect session and/or 'page load time' statistic.

Impact:
The response 'Content-Length' can be wrong.

Workaround:
Uncheck collect 'Page load time' and sessions on analytics profile.

Fix:
Potential memory corruption has been fixed. AVR sets the 'Content-Length' to the right value.

---

639395-1 : AVR does not display 'Max read latency' units.

Solution Article: K91614278

Component: Application Visibility and Reporting

Symptoms:
AVR does not display units for 'Max Read Latency'.

Conditions:
AVR, ASM, DoS, or AFM are provisioned.

Impact:
No units are displayed.

Workaround:
1. Edit the following file: /etc/avr/monpd/monp_disk_info_measures.cfg.
2. Add the following line at line 63: units=microsecond.
3. Restart monpd.

Fix:
Added units (microsecond) to AVR report.

---

638935-7 : Monitor with send/receive string containing double-quote may cause upgrade to fail.★

Component: TMOS

Symptoms:
When you upgrade from an affected version, the config gets saved before moving to the new version, thus dropping the enclosing quotes and causing a load failure when booting into the new version.

Conditions:
Configuration where monitor string contains \" (backslash double-quote) but does not contain one of the following characters: ' (single quote), | (pipe), { (open brace), } (close brace), ; (semicolon), # (hashtag), literal newline, or literal space.

Impact:
Configuration fails to load.

Workaround:
Manually edit each string in the bigip.conf to include enclosing quotes in order to get the config to load the first time.

Fix:
Configs load successfully after upgrade. Surrounding quotes, if missing, are added to strings in the bigip.conf file after upgrade. For example:
\"service_status\":\"on\".+\"maintenance\":\"off\" in the recv, send recv-disable and username fields. Output of list ltm monitor and bigip.conf match. Reloading the same config via tmsh does not cause unintentional changes, such as losing a level of escape in monitor strings.

If you have an escaped quote in your configuration, and are moving to a configuration with this the dependency of this fix, you cannot reload the configuration or the license which also reloads the configuration. Doing so, will cause the config load to fail.

---

638780-1 : Handle 302 redirects for VMware Horizon View HTML5 client

Component: Access Policy Manager

Symptoms:
Starting from v4.4, Horizon View HTML5 client is using new URI for launching remote sessions, and supports 302 redirect from old URI for backward compatibility.

Conditions:
APM webtop with a VMware View resource assigned.
HTML5 client installed on backend is of version 4.4 or later.

Impact:
This fix allows for VMware HTML5 clients v4.4 or later to work properly through APM.

Workaround:
For versions 11.6.x and 12.x:
===============================

priority 2
when HTTP_REQUEST {
    regexp {(/f5vdifwd/vmview/[0-9a-f\-]{36})/} [HTTP::uri] vmview_html5_prefix dummy
}

when HTTP_RESPONSE {
    if { ([HTTP::status] == "302") && ([HTTP::header exists "Location"]) } {
        if { [info exists vmview_html5_prefix] } {
            set location [HTTP::header "Location"]
            set location_path [URI::path $location]
            if { $location_path starts_with "/portal/" } {
                set path_index [string first $location_path $location]
                set new_location [substr $location $path_index]
                regsub "/portal/" $new_location $vmview_html5_prefix new_location
                HTTP::header replace "Location" $new_location
            }
            unset vmview_html5_prefix
        }
    }
}

======================
For version 13.0:
priority 2
when HTTP_REQUEST {
    regexp {(/f5vdifwd/vmview/[0-9a-f\-]{36})/} [HTTP::uri] dummy vmview_html5_prefix
}

when HTTP_RESPONSE {
    if { ([HTTP::status] == "302") && ([HTTP::header exists "Location"]) } {
        if { [info exists vmview_html5_prefix] } {
            set location [HTTP::header "Location"]
            set location_path [URI::path $location]
            if { $location_path starts_with "/portal/" } {
                set path_index [string first $location_path $location]
                set new_location "$vmview_html5_prefix[substr $location $path_index]"
                HTTP::header replace "Location" $new_location
            }
            unset vmview_html5_prefix
        }
    }
}

Fix:
Handle 302 redirects for VMware View HTML5 client are now handled properly.

---

638570-2 : "ACCESS::session remove" hangs in ACCESS_POLICY_COMPLETED

Component: Access Policy Manager

Symptoms:
When "ACCESS:session remove" can hang if it is used within the the ACCESS_POLICY_COMPLETED event. Other commands within the event may not execute.

Conditions:
when ACCESS_POLICY_COMPLETED {
    ACCESS::session remove
}


This iRule was also observed to hang, with the client not receiving the 401 response:
when ACCESS_POLICY_COMPLETED {
    ACCESS::respond 401 content "Error denied..."
    ACCESS:session remove
}

Impact:
ACCESS::session remove cannot be used in the ACCESS_POLICY_COMPLETED event, which may break some use cases. Some Access Exchange iRules are broken from this.

Fix:
Processing of "ACCESS::session remove" was reverted to an earlier version that does not exhibit this behavior.

---

638556-3 : PHP Vulnerability: CVE-2016-10045

Solution Article: K73926196

---

638137-1 : CVE-2016-7117 CVE-2016-4998 CVE-2016-6828

Solution Article: K51201255

---

637666-3 : PHP Vulnerability: CVE-2016-10033

Solution Article: K74977440

---

637181-3 : VIP-on-VIP traffic may stall after routing updates

Component: Local Traffic Manager

Symptoms:
After a routing update traffic for an existing connection sent to a VIP-on-VIP virtual server may be sent directly to the destination address instead of to the inner virtual server.

Conditions:
VIP-on-VIP configuration and static or dynamic routing changes.

Impact:
Existing connections to the outer VIP may stall.

Workaround:
None.

Fix:
Connections to VIP-on-VIP virtual servers no longer stall after routing updates.

---

636702-2 : BIND vulnerability CVE-2016-9444

Solution Article: K40181790

---

636700-3 : BIND vulnerability CVE-2016-9147

Solution Article: K02138183

---

636699-4 : BIND vulnerability CVE-2016-9131

Solution Article: K86272821

---

635933-1 : The validation of ICMP messages for ePVA accelerated TCP connections needs to be configurable

Solution Article: K23440942 K13361021

---

635561-3 : Heavy URLs statistics are not shown after upgrade.

Component: Application Visibility and Reporting

Symptoms:
Heavy URLs statistics are not shown after upgrade.

Conditions:
Upgrading to newer version

Impact:
Missing statistics.

Workaround:
No workaround

Fix:
Upgrade and verify all heavy URLs statistics are shown.

---

635412-2 : Invalid mss with fast flow forwarding and software syn cookies

Solution Article: K82851041

---

635314-4 : vim Vulnerability: CVE-2016-1248

Solution Article: K22183127

---

635274-3 : SSL::sessionid command may return invalid values

Solution Article: K21514205

Component: Local Traffic Manager

Symptoms:
The SSL::sessionid iRule command might return random, invalid values.

Conditions:
An iRule exists that queries the SSL::sessionid.

Impact:
The iRule might not work as expected.

Workaround:
Do not use the SSL:sessionid iRule.

Fix:
The SSL::sessionid iRule returns the session ID as expected.

---

634371-3 : Cisco ethernet NIC driver

Component: TMOS

Symptoms:
The Cisco Ethernet NIC driver is version 2.1.1.67

Conditions:
N/A

Impact:
Cisco recommends using the updated version 2.3.0.12

Fix:
Cisco VIC Ethernet NIC Driver 2.3.0.12 is now used.

---

634259 : IP tuple nexthop object can be freed while still referenced by another structure

Component: Local Traffic Manager

Symptoms:
IP tuple nexthop object can be freed while still referenced by another structure.

Conditions:
This can happen if LSN is in use and the proxy connection takes some time to complete, creating a large enough time window where the nexthop object might be freed.

Impact:
The BIG-IP system might crash. This is a very timing/memory-usage dependent issue that is rarely encountered.

Workaround:
None.

Fix:
Management of IP tuple nexthop object reference counting is more consistent.

---

634001-1 : ASM restarts after deleting a VS that has an ASM security policy assigned to it

Component: Application Security Manager

Symptoms:
ASM restarts with the following errors:

'ltm' log error:
--------
err mcpd[9458]: 0107102e:3: gtm_vs_score refers to nonexistent virtual server (/<partition>/<app>/<vsname>).
--------

'ts_debug.log' error:
--------
asm|INFO|0107102e:3: gtm_vs_score refers to nonexistent virtual server (/<partition>/<app>/<vsname>).
--------

Conditions:
ASM provisioned
Deleting a virtual server that has an ASM security policy assigned to it.

Impact:
ASM restart

Workaround:
None.

Fix:
ASM no longer restarts when deleting a virtual server that has an ASM security policy assigned to it.

---

633723-2 : New diagnostics run when a crypto HA failure occurs and crypto.ha.action is reboot

Component: Local Traffic Manager

Symptoms:
A new db variable has been added to print diagnostic information when Cavium Nitrox devices encounter a "request queue stuck" error.

Conditions:
A Cavium Nitrox "request queue stuck" error occurs and the db variable "crypto.ha.action" is set to reboot.

I.e., when log message such as:
Feb 27 07:39:07 localhost crit tmm1[19936]: 01010260:2: Hardware Error(Co-Processor): cn1 request queue stuck

Impact:
Under the above conditions, the system will automatically run "nitrox_diag" to collect diagnostic information to help F5 determine the cause of the queue stuck error before rebooting.

The system will immediately failover to the standby system, but will then spend approximately one minute gathering diagnostic information beffore rebooting.

See https://support.f5.com/csp/article/K95944198 for more information about nitrox_diag.

Behavior Change:
Under rare conditions, the system will take approximately one additional minute to reboot.

If a Cavium Nitrox "request queue stuck" error occurs and the db variable "crypto.ha.action" is set to reboot, the system will automatically run "nitrox_diag" to collect diagnostic information to help F5 determine the cause of the queue stuck error before rebooting.

When the error happens, failover to the standby system will still happen immediately. The delay is only on rebooting the system which has already gone to standby mode.

---

632798-1 : Double-free may occur if Access initialization fails

Solution Article: K30710317

Component: Access Policy Manager

Symptoms:
Double-free may occur if Access initialization fails.

Conditions:
Access initialization failure occurs, possibly due to license issues.

Impact:
tmm crashes and cores. Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
This release fixes a double free condition so that the associated tmm crash no longer occurs.

---

631722-2 : Some HTTP statistics not displayed after upgrade

Component: Application Visibility and Reporting

Symptoms:
Some statistics will disappear after upgrade due to bug in HTTP statistics backup.

Conditions:
Upgrading to newer version

Impact:
Not all statistics are shown.

Workaround:
No workaround

Fix:
Fixed an issue where some ASM HTTP statistics would disappear after upgrade.

---

631688-4 : Multiple NTP vulnerabilities

Solution Article: K55405388 K87922456 K63326092 K51444934 K80996302

---

631627-5 : Applying BWC over route domain sometimes results in tmm not becoming ready on system start

Component: TMOS

Symptoms:
Rebooting after applying BWC to route domain stops vlan traffic on VCMP guest. You will experience connection failures when bandwidth Controller (bwc) and Web Accelerator are enabled.

Running the tmsh show sys ha-status all-properties command will indicate that tmm is in "ready-for-world", but the Fail status will read "Yes" when this is triggered.

Conditions:
BWC enabled and associated with a route domain, Web Accelerator is enabled, and the system is rebooted.

Impact:
The system does not comes up fully. TMM does not reach a ready state and will not pass traffic.

Workaround:
Remove BWC from route domain and then reapply the BWC back.

Fix:
BWC enabled and associated with a route domain, Web Accelerator enabled, and the system is rebooted, now results in the system and TMM coming up fully and passing traffic.

---

631582-4 : Administrative interface enhancement

Solution Article: K55792317

---

630475-4 : TMM Crash

Solution Article: K13421245

---

628164-2 : OSPF with multiple processes may incorrectly redistribute routes

Component: TMOS

Symptoms:
When OSPF is configured with multiple processes that each redistribute different type routes, LSAs may be created in a process for a route of the type other than the one configured for redistribution into that process.

Conditions:
OSPF routing with multiple processes configured. Each OSPF process configured with a different route type redistributed.

Impact:
Incorrect routing information in the network when OSPF converges.

Workaround:
Redistribute the leaked route type into the affected OSPF process and use a route map that filters out all routes.

Fix:
OSPF no longer leaks LSAs between processes redistributing different types of routes.

---

626360-5 : TMM may crash when processing HTTP2 traffic

Solution Article: K22541983

---

625832-2 : A false positive modified domain cookie violation

Solution Article: K89255958

Component: Application Security Manager

Symptoms:
An unexpected modified domain cookie violation on system that has more than 127 policies configured.

Conditions:
This occurs when more than 127 policies are configured. The violation modified domain cookie is turned on and there are enforced cookies.

Impact:
A false positive violation.

Workaround:
Remove the modified domain cookie violation from blocking.

Fix:
Fixed a false positive modified domain cookie violation.

---

625824-3 : iControl calls related to key and certificate management (Management::KeyCertificate) might leak memory

Component: TMOS

Symptoms:
iControl calls related to Management::KeyCertificate might leak memory slowly, that causes swap space to increase continuously and might lead to exhaustion of swap space

Conditions:
This occurs with the iControl command bigip.Management.KeyCertificate.certificate_export_to_pem

Impact:
iControlPortal.cgi memory increases

Workaround:
Restart httpd to reload the iControl daemon.

Fix:
Fixed a memory leak associated with iControl

---

625376-1 : In some cases, download of PAC file by edge client may fail

Component: Access Policy Manager

Symptoms:
Edge client may fail to download PAC file and incorrectly apply proxy configuration after VPN connection.

Conditions:
- User machine proxy configuration points to a proxy auto configuration file.
- Network access proxy configuration points to a proxy auto configuration file.
- PAC file URI in either case has uppercase characters.
- PAC file is hosted on a server where resource names are case sensitive.

Impact:
PAC file download will fail and client will use incorrect proxy settings due to unavailability of PAC file.

Workaround:
Use only lowercase characters in PAC file URI.

Fix:
Now Edge client can download PAC files from URIs that have uppercase as well as lowercase characters.

---

625372-2 : OpenSSL vulnerability CVE-2016-2179

Solution Article: K23512141

---

625198-3 : TMM might crash when TCP DSACK is enabled

Component: Local Traffic Manager

Symptoms:
TMM crashes

Conditions:
All of the below are required to see this behavior:

DSACK is enabled

MPTCP, rate-pace, tail-loss-probe, and fast-open are disabled.

cmetrics-cache-timeout is set to zero; congestion control is high-speed, new-reno, reno, or scalable; AND Nagle is not set to 'auto'.

an iRule exists that changes any of the conditions above besides DSACK.

various client packet combinations interact in certain ways with the iRule logic.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Change any of the conditions above.

Fix:
TCP maintains state appropriately to avoid crash.

---

624903-3 : Improved handling of crypto hardware decrypt failures on 2000s/2200s or 4000s/4200v platforms.

Component: Local Traffic Manager

Symptoms:
Under rare circumstances some AES-GCM SSL connections can result in a bad record.

Conditions:
AES-GCM SSL record with irregular payload component on a BIG-IP platforms 2000s/2200s or 4000s/4200v.

Impact:
Bad record errors.

Workaround:
None.

Fix:
Irregular SSL payload components are detected, accounted for, and no longer result in a bad record.

---

624616-3 : Safenet uninstall is unable to remove libgem.so

Component: Local Traffic Manager

Symptoms:
When uninstalling Safenet client 6.2 from a BIG-IP chassis, it can't remove libgem.so and generates the following error:

rm: cannot remove `/usr/lib64/openssl/engines/libgem.so': Read-only file system.

Conditions:
This can be triggered when uninstalling the safenet client using the command safenet-sync.sh -u.

Impact:
Uninstall is unable to complete.

Workaround:
None.

Fix:
When uninstalling Safenet client 6.2 from a BIG-IP chassis, the system can now remove libgem.so, so there is no error condition, and uninstall can complete as expected.

---

624570-3 : BIND vulnerability CVE-2016-8864

Solution Article: K35322517

---

624526-1 : TMM core in mptcp

Solution Article: K10002335

---

624457-3 : Linux privilege-escalation vulnerability (Dirty COW) CVE-2016-5195

Solution Article: K10558632

---

624263-3 : iControl REST API sets non-default profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets profile's non-default property value as "none"; properties missing in iControl REST API response

Component: TMOS

Symptoms:
For profiles, iControl REST does not provide visibility for profile property override when "none" is specified, including references, passwords, and array of strings.

Conditions:
-- Use iControl REST API.
-- string, enum, or vector of enum/string property explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf.

Impact:
The iControl REST API response skips these elements. iControl REST does not provide visibility for profile property overrides.

Workaround:
None.

Fix:
iControl REST API now returns elements (i.e., string, enum, or vector of enum/string property that is explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf) with a value "none". The exclusion to this policy is the secured attributes. Secured attributes are always excluded from the iControl REST API response.

---

624245 : Hung tasks leading to system problems and lack of management access via ssh/GUI

Component: TMOS

Symptoms:
Problems with bigd, snmpd and other daemons. System becomes inaccessible via ssh and GUI.

Hung tasks recorded in kern logs, typically snmpd, bigd, chmand, big3d hung.

Caused by Centos kernel bug in netlink code where mutex is left locked on error path.

Conditions:
Seen when a system is handling heavy SNMP traffic and memory is low.

Impact:
SNMP traffic fails with hung tasks. Reboot required.

Workaround:
Apparently reducing SNMP load helps avoid/postpone the problem.

---

624193-1 : Topology load balancing not working as expected

Component: Global Traffic Manager (DNS)

Symptoms:
Under certain conditions, load balancing decisions can result in an unequal or unexpected distribution.

Conditions:
Occurs when topology load balancing is used for a wide IP and more than one pool share the highest assigned score for a particular load balancing decision.

Impact:
The resulting load balancing decisions can lead to an unequal or unexpected distribution of pool selections.

Workaround:
Topology records and pools can be configured to avoid the conditions which cause the condition.

Fix:
A system DB variable, gtm.wideiptoporandom, has been added. When this system DB variable is assigned the value of "enable" and more than one pool shares the highest assigned score for a given load balancing decision, a random pool is selected.

---

624091 : DHCP relay is not forwarding all of the DHCPOFFERS to clients

Component: Policy Enforcement Manager

Symptoms:
When upgrading from v11.5.3 to v11.6.1, DHCPOFFER packets got silently dropped.

Conditions:
If DHCP clients send broadcast DHCP packets with non-zero unicast source IP address via BIG-IP, and regular DHCP discovery packets(0.0.0.0 source IP addrees), multiple client connection flows are created, after some are aged out, BIG-IP may stop relay DHCP server replies back to clients.

Impact:
BIG-IP will stop to relay DHCPOFFER and DHCPACK back
to DHCP clients

Workaround:
Manually delete all system connection flows by doing "delete sys conn" under tmsh.

---

623562-1 : Large POSTs rejected after policy already completed

Component: Access Policy Manager

Symptoms:
When the policy has already completed, access still rejects POSTs greater than 64k. Client will see a reset, and these error messages will appear on the BIG-IP:

/var/log/ltm
Oct 18 19:10:04 bigip6 err tmm[14242]: 01230140:3: RST sent from 10.2.61.80:8080 to 10.2.61.10:55280, [0x1d4cb2c:2863] APM HTTP body too big

/var/log/apm
Oct 19 09:42:37 bigip3922mgmt err tmm1[7636]: 01490514:3: (null):Common:00000000: Access encountered error: ERR_NOT_SUPPORTED. File: ../modules/hudfilter/access/access.c, Function: hud_access_process_ingress, Line: 2960

Conditions:
Policy has already been fully evaluated to allow. Then the client sends a large POST. Only applies to POSTs made to '/'. Would not apply if the URL is something else like '/test'. Also does not apply to clientless modes, where the db key tmm.access.maxrequestbodysize can be used to increase the maximum POST body size allowed.

Impact:
Clients are unable to send POST bodies to '/' that are larger than 64kb, even though the policy has already been evaluated to allow.

Workaround:
Move the resource from '/' to another URL.

Fix:
The logic of '/' in this area was changed to be consistent with other URLs.

---

623401-4 : Intermittent OCSP request failures due to non-optimal default TCP profile setting

Component: TMOS

Symptoms:
The connection between BIG-IP and OCSP responder is not reliable since it uses the default internal TCP configuration which doesn't fit the usage well.

Conditions:
When the OCSP stapling option is enabled in the clientSSL profile that is in use by a virtual server.

Impact:
The BIG-IP as a SSL server fails to staple the OCSP response to the SSL client. In other words, the certificate status messages are not added in the Server Hello message in the TLS handshakes to the SSL client.

Workaround:
The fix proposed an optimal TCP configuration used by the connection between BIG-IP and OCSP responder which makes the connection reliable now. Therefore the virtual server can now always correctly staple the certificate status in the Server Hello message to the SSL client.

---

623135 : BIG-IP virtual server TCP sequence numbers vulnerability (CVE-2002-1463)

Solution Article: K68401558

Component: Local Traffic Manager

Symptoms:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html

Conditions:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html

Impact:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html

Fix:
For more information, see SOL68401558: BIG-IP virtual server TCP sequence numbers vulnerability, available at https://support.f5.com/kb/en-us/solutions/public/k/68/sol68401558.html

---

623119-6 : Linux kernel vulnerability CVE-2016-4470

Solution Article: K55672042

---

622830 : LDAP type CRLDP is parsed incorrectly

Solution Article: K20488861

Component: Access Policy Manager

Symptoms:
After upgrading to 11.6.1 HF1, CRLDP authentication stopped working.

It can be seen from following sample log that the URL is not parsed correctly:

warning apd[15314]: 0149015e:4: fc98d22d: CRLDP Auth agent: CRL lookup failed for LDAP url 'ldap::::389//crl.certificate.../..../certificaterevocationlist?certificateRevocationList' reason 'Invalid CRLDP URL.

Conditions:
The problem occurs only when LDAP type CRLDP is available in the client certificate and it is used from the CRL Distribution Points list.

Impact:
Users may fail access policy evaluation when client certification is used.

Workaround:
Configure other than LDAP type distribution points in the Certificate or if multiple distribution points are present in the client certificate, make sure other than LDAP type scheme succeeds before hitting LDAP CRLDP.

Fix:
The system now parses LDAP type CRLDP URL correctly, so after upgrading, CRLDP authentication now works as expected.

---

622496-6 : Linux kernel vulnerability CVE-2016-5829

Solution Article: K28056114

---

622244-1 : Edge client can fail to upgrade when always connected is selected

Component: Access Policy Manager

Symptoms:
Attempt to upgrade an Edge client may fail if the Always Connected mode is enabled

Conditions:
Always Connected is selected in BIG-IP when upgrading the client

Impact:
Upgrade will fail

Workaround:
Disable the Always Connected mode

Fix:
Upgrade functions as intended regardless of connection mode

---

622178-3 : Improve flow handling when Autolasthop is disabled

Component: Local Traffic Manager

Symptoms:
Modifications made to improve flow handling in configurations which disabled Autolasthop.

Conditions:
Autolasthop disabled.

Impact:
Modifications made to improve flow handling in configurations which disabled Autolasthop.

---

622166 : HTTP GET requests with HTTP::cookie iRule command receive no response

Component: Local Traffic Manager

Symptoms:
HTTP GET requests to virtual servers using the command "HTTP::cookie <name> <value>" in HTTP_REQUEST iRule event handlers do not get a response.

Conditions:
An LTM virtual server with an iRule including the HTTP::cookie command.

Impact:
No response is received by the client.

Workaround:
None.

Fix:
HTTP GET requests to virtual servers using the command "HTTP::cookie <name> <value>" in HTTP_REQUEST iRule event handlers now get a response as expected.

---

622133-4 : VCMP guests may incorrectly obtain incorrect MAC addresses

Component: TMOS

Symptoms:
vCMP guests may be re-configured to use MAC addresses based off an all zero MAC address (00:00:00:00:00:00).

The 'tmsh show net vlan' command will show the vlan interfaces having mostly 0's in the MAC address:

-------------------------------------
Net::Vlan: external
-------------------------------------
Interface Name external
Mac Address (True) 00:00:00:00:00:01
MTU 1500
Tag 3702
Customer-Tag

-------------------------------------
Net::Vlan: internal
-------------------------------------
Interface Name internal
Mac Address (True) 00:00:00:00:00:02
MTU 1500
Tag 3703
Customer-Tag

Conditions:
For this to manifest the vCMP host vcmpd process will have to have had a prior crash or be killed.
In this scenario vcmpd on restart uses a default zero-base MAC address for the guests.
The guests will not use the new zero-based MAC until services are restarted on the guest, on which the new MAC address will take effect.

Impact:
This can cause network issues and conflicts if occurring on multiple guests in the same VLAN as the same MAC addresses will be used.

Workaround:
Restart the guest from the hypervisor.

Fix:
vCMP no longer uses zero-based MACs on vcmpd crash/kill.

---

622126-3 : PHP vulnerability CVE-2016-7124

Solution Article: K54308010

---

621935-3 : OpenSSL vulnerability CVE-2016-6304

Solution Article: K54211024

---

621524-3 : Processing Timeout When Viewing a Request with 300+ Violations

Component: Application Security Manager

Symptoms:
When attempting to view a request that triggered hundreds or thousands of violations, a timeout is encountered.

Conditions:
Attempting to view a request that triggered hundreds or thousands of violations

Impact:
A timeout is encountered.

Workaround:
increase the "max_execution_time" timeout in /usr/loca/lib/php.ini from 30 to 240 seconds.

Fix:
Processing high violation requests is now more efficient.

---

621417-1 : sys-icheck error for /usr/share/defaults/bigip_base.conf in AWS.

Component: TMOS

Symptoms:
On a BIG-IP deployed in AWS cloud, sys-icheck reports size an md5 errors for /usr/share/defaults/BIG-IP_base.conf file as following:

ERROR: S.5...... c /usr/share/defaults/BIG-IP_base.conf (no backup)

Conditions:
BIG-IP deployed in AWS cloud.

Impact:
sys-icheck reports "rpm --verify" size and md5 errors for /usr/share/defaults/BIG-IP_base.conf. This doesn't have any functional impact on the product but looks like factory config file was modified incorrectly by a user/application.

Workaround:
No workaround exists for this issue.

Fix:
sys-icheck error for /usr/share/defaults/BIG-IP_base.conf in AWS.

---

621273-4 : DSR tunnels with transparent monitors may cause TMM crash.

Component: TMOS

Symptoms:
The TMM may crash if the BIG-IP system is configured with a DSR tunnel with a transparent monitor.

Conditions:
The BIG-IP system is configured with a DSR tunnel with a transparent monitor and the DB variable tm.monitorencap is set to "enable".

Impact:
Traffic disrupted while tmm restarts.

Fix:
The TMM does not crash.

---

621242 : Reserve enough space in the image for future upgrades.

Component: TMOS

Symptoms:
Increased the reserved free space in VM image from 15% to 30% to accommodate upgrades to future versions. Each next version tends to be bigger and require more disk space to install. The increased reserved space will allow upgrading to at least next 2 versions.

Conditions:
VE in local hypervisors and VE in the Cloud (AWS, Azure).

Impact:
Extends the disk image to reserve more disk space for upgrades.

Workaround:
N/A

Fix:
Increased the reserved free space on VE images.

---

621239-1 : Certain DNS queries bypass DNS Cache RPZ filter.

Component: Global Traffic Manager (DNS)

Symptoms:
A DNS query with the DO-bit set to 1 will bypass the RPZ filter on a DNS Cache.

Conditions:
A DNS Cache configured with RPZ.

Impact:
Queries with DO-bit set to 1 will bypass the RPZ filter and be answered normally.

Fix:
The DO-bit is now ignored with respect to RPZ filtering.

---

621202-1 : Portal Access: document.write() with very long string as argument may be handled incorrectly.

Component: Access Policy Manager

Symptoms:
JavaScript code may include document.write() calls with very long strings (> 60K). In some cases these strings may be rewritten incorrectly.

Conditions:
- document.write() with very long string as argument.
- argument string contains HTML tags with quoted attribute values which include '>' inside.

Impact:
rewritten HTML page may not work correctly.

Fix:
Now document.write() calls with long HTML strings are handled correctly by Portal Access.

---

620922-1 : Online help for Network Access needs update

Component: Access Policy Manager

Symptoms:
Online help for advanced network settings does not tell users that if they fill in the DNS Address Space setting, they also need to install the DNS Relay Proxy service on Windows-based systems to get the desired result.

Conditions:
Split tunneling configured. Windows-based system in use. DNS Address Space setting filled in.

Impact:
Use of DNS Address Space setting does not provide the expected result.

Workaround:
Install the DNS Relay Proxy server on Windows-based systems.

Fix:
Network Access online help now states that for DNS Address Space to work properly on a Windows-based system, the DNS Relay Proxy service must be installed and running on the client.

---

620829-4 : Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly

Component: Access Policy Manager

Symptoms:
JavaScript code with literal object definition containing field names equal to reserved keywords is not handled correctly by Portal Access.

Conditions:
JavaScript code with literal object definition containing fields with reserved keywords as a name, for example:

var a = { default: 1, continue: 2 };

Impact:
JavaScript code is not rewritten and may not work correctly.

Workaround:
None.

Fix:
Now JavaScript with literal object definition containing reserved keywords as field names is handled correctly by Portal Access.

---

620712-1 : Added better search capabilities on the Pool Members Manage & Pool Create page.

Component: Global Traffic Manager (DNS)

Symptoms:
Large amount of virtual servers were hard to manage on the GSLB Pool Member Manage page.

Conditions:
Having large amount of virtual servers/wide ips

Impact:
Poor usability.

Workaround:
No workaround.

Fix:
The GSLB Pool Member Manage page now has a new search feature in the form of a combo box to allow for better management of large amount of virtual servers.

Behavior Change:
The GSLB Pool Member Manage page now has the new search feature to allow for better management of large amount of virtual servers.

---

620614-2 : Citrix PNAgent replacement mode: iOS Citrix receiver fails to add new store account

Component: Access Policy Manager

Symptoms:
iOS Citrix receiver fails to add new store account and touching on the Save option after providing the credentials displays "Loading" and comes back to previous save option.

/var/log/apm displays "An exception is thrown: EVP_CipherFinal_ex failed: EVP_DecryptFinal_ex:bad decrypt" from VDI.

The above error, otherwise, below error which deletes the session id abruptly.

Oct 24 16:33:12 slot2/vip-guest7-test notice tmm[11547]: 01490567:5: /Common/mvdi-r_ap:Common:e19516fd: Session deleted (internal_cause).

Conditions:
APM is configured with Citrix replacement mode. Provide wrong passcode values for RSA SecurId auth for continuously three times which trigger the next token input for the fourth time entering the right passcode. APM rotate session is enabled.

Impact:
iOS Citrix receiver could not add the account after providing wrong token values for two factor auth

Workaround:
Kill the iOS Citrix receiver application and click on the receiver again to add the account.

Fix:
Use the right session id for decrypting the password.

---

620215-3 : TMM out of memory causes core in DNS cache

Component: Global Traffic Manager (DNS)

Symptoms:
The TMM crashes and service is lost until it restarts. You may see several "aggressive mode sweeper" messages in /var/log/ltm prior to the crash.

Conditions:
This can occur when the TMM memory is exhausted.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Provision sufficient memory for the TMM or reduce load.

Fix:
The fix was to properly handle the failure allocating memory.

---

619879-3 : HTTP iRule commands could lead to WEBSSO plugin being invoked

Component: Access Policy Manager

Symptoms:
With SSO logs set to 'Debug' in Access log configuration, the following log messages are seen in '/var/log/apm':
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: constructor
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: webssoContext constructor ...
Sep 30 12:46:17 bigip3900mgmt err websso.3[14520]: 014d0005:3: Unsupported SSO Method
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: ctx: 0x914b510, SERVER: TMEVT_REQUEST
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: ctx: 0x914a718, CLIENT: TMEVT_ABORT_PROXY
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: webssoContext destructor ...
Sep 30 12:46:17 bigip3900mgmt debug websso.3[14520]: 014d0001:7: webssoConfig destructor

With 'rstcause' enabled, the following log message is seen in '/var/log/ltm':
Sep 30 12:46:17 bigip3900mgmt err tmm2[13116]: 01230140:3: RST sent from 172.17.90.92:57611 to 127.0.0.1:10001, [0x24ccbbc:820] Internal error (APM::WEBSSO requested abort (Unsupported SSO Method))

Conditions:
HTTP::disable followed by HTTP::enable.

when CLIENT_ACCEPTED {
    HTTP::disable
    // do some other stuff
    HTTP::enable
}

Impact:
client receives a HTTP 503 reset

Workaround:
When the access profile is added to the virtual server, the websso plugin profile is automatically added. Manually removing the websso plugin fixes this bug.

Fix:
The server-side access hudfilter was mistakenly enabling the websso plugin. The logic has been updated so that this does not happen.

---

619757-3 : iSession causes routing entry to be prematurely freed

Component: Wan Optimization Manager

Symptoms:
iSession may cause TMM to prematurely free a routing entry resulting in memory corruption and TMM restarting.

Conditions:
iSession-enabled virtual.

Impact:
Traffic disrupted while TMM restarts.

Workaround:
No reasonable workaround short of not using iSession functionality.

Fix:
iSession no longer causes routing entries to be prematurely freed.

---

619710 : GUI gives error when clicking "Update" making changes to VS in Security-Policies

Component: Advanced Firewall Manager

Symptoms:
GUI times out and generates an error when ASM policy takes longer time to update (in Virtual Server Security page)

Conditions:
When the same ASM policy is attached to hundreds of virtual servers, it takes longer to update.

Impact:
GUI times out before the changes are saved. Users will be able to see the updated changes only after refreshing the page.

Workaround:
Refresh the page in the browser once the error shows up.

Fix:
GUI doesn't time out when ASM policy is updated.

---

619528-2 : TMM may accumulate internal events resulting in TMM restart

Component: Local Traffic Manager

Symptoms:
Under some uncommon circumstances, long-lived connections may cause internal events to be accumulated causing excessive memory usage potentially resulting in TMM restarting.

Conditions:
HTTP virtual with long-lived connections.

Impact:
Traffic disrupted while TMM restarts.

Workaround:
The issue can be mitigated by setting the HTTP 'max-requests' profile option to a reasonably low value - this value will depend on application requirements.

Fix:
Internal events are no longer accumulated thus avoiding low memory conditions.

---

619486-1 : Scripts on rewritten pages could fail with JavaScript exception if application code modifies window.self

Component: Access Policy Manager

Symptoms:
Attempts to call some JavaScript methods (such as XMLHttpRequest.open) on a page accessed through Portal Access could fail if application modifies window.self builtin object. As a result, the application will stop working and optionally log an undefined variable/reference exception into Developer Tools console.

To verify that window.self is modified, run 'window.self == window' command in Developer Tools console of the page with error and check if it returns 'false'.

Conditions:
This can occur if a web application has javascript that modifies the value of window.self.

Impact:
Affected web-applications will not work when accessed through Portal Access.

Workaround:
None

Fix:
Scripts on pages accessed through Portal Access are no longer failing when web application code modifies window.self.

---

619398-4 : TMM out of memory causes core in DNS cache

Component: Global Traffic Manager (DNS)

Symptoms:
The TMM crashes and service is lost until it restarts. You may see several "aggressive mode sweeper" messages in /var/log/ltm prior to the crash.

Conditions:
This can occur when the TMM memory is exhausted.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Provision sufficient memory for the TMM or reduce load.

Fix:
The fix was to properly handle the failure allocating memory.

---

619060-2 : Reduction in boot time in BIG-IP Virtual Edition platforms

Component: TMOS

Symptoms:
BIG-IP Virtual Edition (VE) version has experienced increased boot time.

Conditions:
The increased boot time occurs each time a VE is booted.

Impact:
Long boot time, longer than previous releases.

Workaround:
None.

Fix:
Reduction in boot time in BIG-IP Virtual Edition platforms.

---

618905-3 : tmm core while installing Safenet 6.2 client

Component: Local Traffic Manager

Symptoms:
tmm core while installing Safenet 6.2 client.

Conditions:
Safenet 6.2 client installation

Impact:
Traffic disrupted while tmm restarts.

Fix:
Fixed a tmm core related to Safenet 6.2 client installation.

---

618902-3 : PCCD memory usage increases on configuration changes and recompilation due to small amount of memory leak on each compilation

Component: Advanced Firewall Manager

Symptoms:
Each time the Packet Classification Compiler Daemon (PCCD) process recompiles rules due to configuration changes, it loses approximately 20 bytes or more (depends on the rule complexity) due to small memory leak.

Conditions:
This occurs when making changes to the firewall configuration when AFM is configured.

Impact:
This can potentially lead to an out-of-memory situation if the system runs for a long time without reboot and PCCD continuously recompiles due to frequent configuration changes.

Workaround:
None.

Fix:
The PCCD memory leak was identified and fixed.

---

618771-2 : Some Social Security Numbers are not being masked

Component: Application Security Manager

Symptoms:
ASM does not block or mask some SSN numbers.

Conditions:
The Data Guard feature is turned on and set to Block, Alarm or Mask. The responses contains social security numbers with specific ranges.

Impact:
The traffic passes neither masked nor blocked to the end client.

Workaround:
None.

Fix:
The system now correctly masks and/or blocks all relevant social security numbers.

---

618517-2 : bigd may falsely complain of a file descriptor leak when it cannot open its debug log file

Component: Local Traffic Manager

Symptoms:
- On 11.6.1, bigd will report erroneously mark pool members down and messags similar to the following will be seen in the ltm log file:

Sep 23 10:45:59 bipve1 warning bigd[7413]: 01060154:4: Bigd PID 7413 throttling monitor instance probe because file descriptor limit 65436 reached.

- On 12.1.x, this bug has negligible impact.

Conditions:
Monitoring must be in use, bigd debug logging must be enabled, and the bigd debug log file (/var/log/bigdlog) must be full.

Impact:
- On 11.6.1 this can cause bigd to stop monitoring, resulting in pool members being marked down erroneously.

- In 12.1.x, some of the underlying logging code changed and there is no real impact.

Workaround:
You can rotate the log file, using the following command:
logrotate -f bigdlog

Fix:
Stopped bigd from thinking it was out of file descriptors when it was unable to open its debug log file.

---

618324-2 : Unknown/Undefined OPSWAT ID show up as 'Any' in APM Visual Policy Editor

Component: Access Policy Manager

Symptoms:
When upgrading from OPSWAT SDK V3 to V4, opening Access Policy in VPE if one of the opswat checker (e.g. Anti-Virus checker) contains an Undefined (i.e. previously defined but out of support) ID it will display as "Any." The correct display should be "Unsupported" or "Invalid" product.

Conditions:
Wrongful information displayed.

Impact:
Wrongful information displayed.

Workaround:
N/A

Fix:
Correct (*** Invalid ***) information displayed.

---

618261-3 : OpenSSL vulnerability CVE-2016-2182

Solution Article: K01276005

---

618170-1 : Some URL unwrapping functions can behave bad

Component: Access Policy Manager

Symptoms:
Some URL unwrapping functions can behave incorrectly with different web application malfunctions as a result.

Conditions:
JavaScript with "location.pathname" like fields at the right side of an expression.

Impact:
Different web application malfunctions. One example is SharePoint 2010 using IE11, clicking the Edit button results in "Only secure content is displayed" at the bottom of the page.

Fix:
Fixed.

---

617862-1 : Fastl4 handshake timeout is absolute instead of relative

Component: Local Traffic Manager

Symptoms:
TCP connections that are pending completion of the three-way handshake are expired based on the absolute value of handshake timeout. For example, if handshake timeout is 5 seconds, then the connection is reset after 5 seconds of receiving the initial SYN from the client.

Conditions:
A TCP connection in three-way handshake.

Impact:
Connections are expired prematurely if they are still in three-way handshake.

Workaround:
Disable handshake timeout.

Impact of workaround: Your TCP handshake will not prematurely timeout and connections remains open until the Idle Timeout expires.

Fix:
The handshake timeout now expires based on idleness of the connection, taking into consideration of any SYN retransmissions, etc., that might occur.

---

617858-1 : bigd core when using Tcl monitors

Component: Local Traffic Manager

Symptoms:
If a Tcl monitor encounters an error, it may exit with an assert which causes bigd to core.

Conditions:
This can occur rarely when Tcl monitors are in use (specifically, SMTP, FTP, IMAP, POP3 monitors).

Impact:
bigd can core, which temporarily suspends monitoring while bigd restarts.

Workaround:
None.

Fix:
Now, when a Tcl monitor encounters an error, it no longer exits with an assert, so bigd no longer cores.

---

617824-2 : "SSL::disable/enable serverside" + oneconnect reuse is broken

Component: Local Traffic Manager

Symptoms:
If "SSL::disable/enable serverside" is configured in an iRule and oneConnect is configured in the iRule or in the Virtual Server profile, BIG-IP may not receive the backend server's HTTP response for every client's HTTP Request.

Conditions:
1. "SSL::disable/enable serverside" exists in the iRule
2. OneConnect is configured in the iRule or in the VS profile
3. apply the iRule and oneConnect Profile to the VS.

Impact:
The oneConnect behavior is unexpected, and may not get the backend Server's HTTP response for every client's HTTP Request.

Workaround:
You can work around the problem by disabling oneConnect.

---

617628-2 : SNMP reports incorrect value for sysBladeTempTemperature OID

Component: TMOS

Symptoms:
SNMP reports incorrect value for sysBladeTempTemperature OID, while TMSH reports the corresponding value correctly.

# snmpwalk -v2c -c public localhost .1.3.6.1.4.1.3375.2.1.3.2.4.2.1.2.8.1
F5-BIGIP-SYSTEM-MIB::sysBladeTempTemperature.8.1 = Gauge32: 4294967245

# tmsh show sys hardware

Sys::Hardware
Blade Temperature Status
  Slot Index Lo Limit(C) Temp(degC) Hi Limit(C) Location
...
  1 8 0 -48 0 Blade CPU #1 TControl Delta tem
...

The negative "Blade CPU #1 TControl Delta" temperature is being incorrectly reported as a large positive temperature by SNMP.

Impact:
A negative temperature may be incorrectly reported by SNMP as an impossibly high positive value.

Workaround:
Use tmsh show sys hardware to view blade temperatures. Negative temperatures are properly reported.

config # tmsh show /sys hardware
Sys::Hardware
Blade Temperature Status
  Slot Index Lo Limit(C) Temp(degC) Hi Limit(C) Location
  1 1 0 19 49 Blade air outlet temperature 1
  1 2 0 14 41 Blade air inlet temperature 1
  1 3 0 21 57 Blade air outlet temperature 2
  1 4 0 16 41 Blade air inlet temperature 2
  1 5 0 25 60 Mezzanine air outlet temperatur
  1 6 0 27 72 Mezzanine HSB temperature 1
  1 7 0 17 63 Blade PECI-Bridge local tempera
  1 8 0 -48 0 Blade CPU #1 TControl Delta tem
  1 9 0 25 68 Mezzanine BCM56846 proximity te
  1 10 0 22 69 Mezzanine BCM5718 proximity tem
  1 11 0 19 57 Mezzanine Nitrox3 proximity tem
  1 12 0 16 46 Mezzanine SHT21 Temperature

---

617316-1 : Desktop title is garbled for Citrix Storefront integration mode with non-sta configuration

Component: Access Policy Manager

Symptoms:
Desktop launched from browser or from native receiver has garbled title.

Conditions:
Citrix storefront integration mode through APM with no STA configured. Double byte language such as Japanese character set is used in the backend.

Impact:
Desktop title is not shown properly.

Workaround:
None

Fix:
Double byte character language title is shown properly

---

617310-1 : Edge client can fail to upgrade when Always Connected is selected★

Component: Access Policy Manager

Symptoms:
Attempt to upgrade from an Edge client version to a current version fails when Always Connected is enabled

Conditions:
Always Connected is selected in BIG-IP when upgrading the client.

Impact:
Upgrade fails. Must turn off Always Connected to upgrade client.

Workaround:
Turn off Always Connected before upgrading.

Fix:
Edge client now succeeds during upgrade when Always Connected is selected.

---

617002-3 : SWG with Response Analytics agent in a Per-Request policy fails with some URLs

Component: Access Policy Manager

Symptoms:
SWG with Response Analytics agent in a Per-Request policy fails with some URLs

Conditions:
Response analytics agent is added to per-request policy and per-request policy is attached to the virtual. APM and SWG are provisioned and licensed.

Impact:
Client might receive resets for some URLs when response analytics doesn't function correctly.

Workaround:
Remove response analytics agent from the per-request policy and perform categorization based only on URLs.

Fix:
Correctly handle the response analytics for these URLs and dont send resets to client.

---

616864-3 : BIND vulnerability CVE-2016-2776

Solution Article: K18829561

---

616838 : Citrix Remote desktop resource custom parameter name does not accept hyphen character

Component: Access Policy Manager

Symptoms:
While adding the custom parameter in Citrix Resource would give parser error as following,

01070734:3: Configuration error: apm resource remote-desktop /Common/ctx_resource: Parse error on line 1: DesktopViewer-ForceFullScreenStartup=On"

Conditions:
Having Citrix resource with custom parameter name with hyphen character

Impact:
Custom parameter can not be used with hyphen character

Workaround:
None

Fix:
Accept custom parameter name with hyphen character

---

616242-2 : basic_string::compare error in encrypted SSL key file if the first line of the file is blank★

Solution Article: K39944245

Component: TMOS

Symptoms:
Trying to load a configuration that references an encrypted SSL key file may fail if the first line of the SSL key file is blank. When this occurs, the system will report a vague error message:

    01070711:3: basic_string::compare

If this happens during an upgrade, the system will not load the configuration under the new software version, and will remain inoperative.

Conditions:
This can occur if an affected configuration is present on a system running BIG-IP v11.3.0 or earlier, and is upgraded to BIG-IP v11.4.0 through v12.1.1.

Impact:
Configuration fails to load on upgrade with extremely unhelpful error message, and absolutely no indication as to what file was being processed at the time (or that this relates to a filestore file).

Workaround:
Remove the newlines at the beginning of any SSL key files that begin with a newline. During an upgrade scenario, edit the files in the filestore.

---

616215-2 : TMM can core when using LB::detach and TCP::notify commands in an iRule

Component: Local Traffic Manager

Symptoms:
TMM cores when running an iRule that has the LB::detach command before the TCP::notify command.

Conditions:
A virtual server with an iRule that has the LB::detach command executed before the TCP::notify command.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid the combination of the TCP::notify and LB::detach commands.

Fix:
TMM no longer cores in this instance.

---

616169-2 : ASM Policy Export returns HTML error file

Component: Application Security Manager

Symptoms:
When attempting to export an ASM Policy the resulting file contains an HTML error page.

Conditions:
It is not known what triggers this condition.

Impact:
Unable to export ASM Policies.

Workaround:
Delete all files in /ts/dms/policy/upload_files/. All files are transient and can safely be deleted.

Fix:
Permissions are now explicitly set on exported ASM Policies so the GUI PHP process can successfully download it.

---

615970-2 : SSO logging level may cause failover

Solution Article: K02319425

Component: Access Policy Manager

Symptoms:
SSO logging level may cause failover.

Conditions:
SSO logging level set to "Debug".

Impact:
TMM may crash. Core file may be generated.

Workaround:
Lower the SSO log level from "Debug" to either "Info" or "Notice".

Fix:
The SSO logging level of "Debug" no longer causes failover.

---

615934-2 : Overwrite flag in various iControl key/certificate management functions is ignored and might result in errors.

Component: TMOS

Symptoms:
Overwrite flag in key/certificate management iControl functions is ignored and might result in errors.

Conditions:
If there is an existing key/certificate, and the key/certificate management iControl functions are used to overwrite the key/certificate by setting the overwrite flag, the flag is ignored, and an error is returned.

Impact:
Key/certificate overwrite using iControl operations might fail.

Fix:
The fix honors the overwrite flag, so that the key/certificate is overwritten when the flag is set to true.

---

615260 : out of memory condition when URL categorization is configured to work with large feedlists

Component: Traffic Classification Engine

Symptoms:
out of memory condition when URL categorization is configured to work with large (millions of records) feedlists.

Conditions:
In order to hit this issue user would have to load and unload large feedlist multiple times

Impact:
SWAP memory will increase and will eventually lead the box to run out of memory

Fix:
This problem is fixed in v12.1

---

615187-1 : Missing hyperlink to GSLB virtual servers and servers on the pool member page.

Component: Global Traffic Manager (DNS)

Symptoms:
Hyperlinks to to GSLB virtual servers and servers on the pool member page were removed in 11.x.

Conditions:
Have a GSLB pool with pool members set up.

Impact:
Must manually note of the member's virtual or server.

Workaround:
Manually take note of virtual or server and search for it.

Fix:
Added hyperlink to GSLB virtuals and servers on the pool member page.

---

614891-4 : Routing table doesn't get updated when EDGE client roams among wireless networks

Component: Access Policy Manager

Symptoms:
Clients using the EDGE client report that they are unable to reach the VPN when they switch wifi networks.

Conditions:
This is triggered when a device running the EDGE client is on a wifi network, then roams to another wifi network that has a different default route.

Impact:
Clients have an incorrect route to the VPN and are forced to re-connect.

---

614865-2 : Overwrite flag in iControl functions key/certificate_import_from_pem functions is ignored and might result in errors.

Component: TMOS

Symptoms:
Overwrite flag in iControl functions key/certificate_import_from_pem functions is ignored and might result in errors.

Specifically, the functions are:
key_import_from_pem()
certificate_import_from_pem()
key_import_from_pem_v2()
certificate_import_from_pem_v2()

Conditions:
When there is an existing key or certificate on the BIG-IP system, and you want to overwrite them using key_import_from_pem(), certificate_import_from_pem(), key_import_from_pem_v2(), or certificate_import_from_pem_v2() iControl calls, it results in errors stating that the key or certificate already exists on the BIG-IP system.

Impact:
Cannot overwrite the key/certificate file-objects using these iControl calls.

Workaround:
There are two workarounds:
- Delete and import the key/certificate using key_import_from_pem(), certificate_import_from_pem(), key_import_from_pem_v2(), or certificate_import_from_pem_v2() iControl calls.

- Use key_import_from_file and certificate_import_from_file iControl calls as an alternative to import key/certificate from a file.

Fix:
Overwrite flag in iControl functions key/certificate_import_from_pem_v2() functions are now processed correctly and no longer produce errors.

---

614563-1 : AVR TPS calculation is inaccurate

Component: Advanced Firewall Manager

Symptoms:
The TPS that AVR calculates for DoS is 11% more than the real TPS.

Conditions:
DoS profile attached to the virtual server.

Impact:
Attack can wrongly be detected.

Workaround:
None.

Fix:
TPS that AVR calculates for DoS now reflects the actual TPS.

---

614322-3 : TMM might crash during handling of RDG-RPC connection when APM is used as RD Gateway

Solution Article: K31063537

Component: Access Policy Manager

Symptoms:
TMM might crash during handling of RDG-RPC connection when APM is used as RD Gateway.

Conditions:
RDP client uses RDG-RPC protocol to connect via APM's RD Gateway implementation.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
N/A

Fix:
Fixed TMM crash, which occurred during RDG-RPC protocol handling.

---

614147-3 : SOCKS proxy defect resolution

Solution Article: K02692210

---

613673-1 : Pool members may not be marked up and/or there might be a slight delay in monitors

Solution Article: K48693281

Component: Local Traffic Manager

Symptoms:
A UDP monitor might fail to mark a pool member up even when the pool member is up.

Other monitor types may mark a pool member down.

A slight delay (less than 0.1 seconds) might be noticed in monitor traffic sent by the BIG-IP.

Conditions:
To experience the incorrect pool member status issue, there is generally some other monitor on the system that is legitimately down.

To experience the delay, run an affected version. The issue has been observed with TCP, HTTP, and HTTPS monitors.

Impact:
Incorrect pool member status or pool member flapping.

Connections to monitored pool members might last slightly longer than necessary.

Workaround:
None.

Fix:
In this release, the system now correctly sets pool member status and connections to monitored pool members no longer last longer than necessary.

---

613613-1 : Incorrect handling of form that contains a tag with id=action

Component: Access Policy Manager

Symptoms:
In some cases, a form with an absolute path in the action is handled incorrectly in Internet Explorer (IE) versions 7, 8, and 9. The resulting action path is wrong and the form cannot be submitted.

Conditions:
This issue occurs under these conditions:
-- HTML Form with absolute action path.
-- A tag with id=action inside this form.
-- A submit button in the form.
-- IE versions 7 through 9.

Impact:
The impact of this issue is that the web application can not work as expected.

Workaround:
This issue has no workaround at this time.

Fix:
Forms with absolute action paths and tag with id=action inside are handled correctly.

---

613576-2 : QOS load balancing links display as gray

Component: Global Traffic Manager

Symptoms:
All links in all data centers appear gray. After this patch all link appear to be green and the functional of load balancing to the first available link in each pool is restored.

Conditions:
This bug only affects devices licensed after 9/1/2016 which contain the gtm_lc: disabled field.

Impact:
Any GTM/LC devices licensed after 9/1/2016 and using links as part of their configuration will have the links reported as gray.

Workaround:
Remove all ilnks from configuration or install this hotfix.

---

613536-2 : tmm core while running the iRule STATS:: command

Component: TMOS

Symptoms:
With an iRule that runs the STATS::set command inside the ACCESS_SESSION_CLOSED event, tmm cores.

Conditions:
STATS:: command invoked inside the ACCESS_SESSION_CLOSED event. This event does not have all of the connection information so invoking STATS:: to store data from the connection will fail and cause tmm to crash.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not use STATS::set inside ACCESS_SESSION_CLOSED

---

613369-1 : Half-Open TCP Connections Not Discoverable

Component: Local Traffic Manager

Symptoms:
New TCP connection requests are reset after a specific sequence of TCP packets.

Conditions:
A TCP connection in half-open state.

Impact:
Half-open TCP connections are not discoverable

Fix:
Properly acknowledge half-open TCP connections.

---

613225-3 : OpenSSL vulnerability CVE-2016-6306

Solution Article: K90492697

---

613127-6 : Linux TCP Stack vulnerability CVE-2016-5696

Solution Article: K46514822

---

613088-1 : pkcs11d thread has session initialization problem.

Component: Local Traffic Manager

Symptoms:
pkcs11d does not initialize, especially in the secondary slot(s). SafeNet connections cannot be established on the secondary blades.

Conditions:
This occurs when SafeNet is configured with VIPRION chassis

Impact:
When this occurs, BIG-IP is unable to establish SafeNet connections from the secondary blades.

Workaround:
None.

Fix:
Fixed a pkcs11d thread session initialization problem that prevented SafeNet connections.

---

613045 : Interaction between GTM and 10.x LTM results in some virtual servers marked down

Component: Global Traffic Manager

Symptoms:
Some GTM virtual servers are never marked up when interacting with 10.x LTM.

Conditions:
1. On a GTM server, with autoconf off, manually create a virtual server that is using translated IP/port and either no LTM virtual server name or an incorrect LTM virtual server name.
2. Make sure the LTM virtual server is available.

Impact:
On the GTM side, that LTM virtual server will never get marked up.

Workaround:
None.

Fix:
Interaction between GTM and 10.x LTM now works, so virtual servers are correctly marked up.

---

612694-3 : TCP::close with no pool member results in zombie flows

Component: Local Traffic Manager

Symptoms:
'tmsh show sys conn all-properties' shows connections whose idle time exceeds the timeout.

Conditions:
There is no pool member, and a TCP::close iRule activates (typically after a TCP::respond).

Impact:
Connection does not tear itself down.

Workaround:
Make TCP::close conditional on pool failure, and rely on the pool failure to RST the connection rather than perform a clean TCP close.

Fix:
The system now properly handles TCP teardown when TCP::close has already torn down the rest of the stack.

---

612419-2 : APM 11.4.1 HF10 - suspected memory leak (umem_alloc_32/network access (variable))

Component: Access Policy Manager

Symptoms:
When there are multiple network access resources, and users switch between them within the same connection, a small memory leak happens.

Conditions:
Network access; full webtop, multiple Network Access resources.

Impact:
Memory usage increases over time.

Workaround:
There is no workaround. It is a relatively slow leak though. In the case where it was observed, the leak was about 130MB per month.

Fix:
Fixed a memory leak related to network access.

---

612229-2 : TMM may crash if LTM a disable policy action for 'LTM Policy' is not last

Component: Local Traffic Manager

Symptoms:
TMM may crash while processing an LTM policy.

Conditions:
- VIP with LTM policy attached.
- LTM policy contains rule with 2 or more actions.
- Policy action of disable - LTMN Policy is not the last one in the list of actions.

Impact:
TMM crash with the following in one of the /var/log/tmm log files:
notice ** SIGABRT **
Traffic disrupted while tmm restarts.

Workaround:
Ensure any LTM policy disable action is the last in the list of actions.

Fix:
TMM no longer crashes if LTM a disable policy action for 'LTM Policy' is not last in the list of actions in the rule.

---

612128 : OpenSSH vulnerability CVE-2016-6515

Solution Article: K31510510

---

611968-1 : JavaScript Active content at an HTML page browsed by IE8 with significant amount of links (>1000) can run very slow

Component: Access Policy Manager

Symptoms:
JavaScript Active content at an HTML page browsed by IE8 with significant amount of links (>1000) can run very slow.

Conditions:
- IE8 only.
- Significant number of links: >1000.
- JavaScript event handlers presence.

Impact:
Web application performance slowdown.

Workaround:
None

Fix:
Fixed.

---

611669-1 : Mac Edge Client customization is not applied on macOS 10.12 Sierra

Component: Access Policy Manager

Symptoms:
Mac Edge Client's Icon, application name, company name, amongst other things can be customized on BIG-IP before deploying on end user's machine. But on Mac Edge Client on macOS 10.12 Sierra this customization is not applied.

Conditions:
macOS Sierra 10.12, Edge client, customization

Impact:
Mac Edge Client customization is not applied on macOS 10.12 Sierra. Functionally there should be no impact except that user will see default application visually.

Workaround:
run following command on Terminal and re-launch Edge client:

For English:
$ defaults write -globalDomain AppleLanguages -array "en" "en-US"

For German:
$ defaults write -globalDomain AppleLanguages -array "de" "de-US"

For Korean:
$ defaults write -globalDomain AppleLanguages -array "ko" "ko-US"

For Japanese
$ defaults write -globalDomain AppleLanguages -array "ja" "ja-US"

For French
$ defaults write -globalDomain AppleLanguages -array "fr" "fr-US"

For spanish
$ defaults write -globalDomain AppleLanguages -array "es" "es-US"

For Chinese traditional
$ defaults write -globalDomain AppleLanguages -array "zh-Hant" "zh-Hant-TW" "zh-Hant-US"

For Chinese simplified
$ defaults write -globalDomain AppleLanguages -array "zh-Hans" "zh-Hans-US"

Fix:
Edge client honors customization on macOS Sierra 10.12 now.

---

611469-2 : Traffic disrupted when malformed, signed SAML authentication request from an authenticated user is sent via SP connector

Solution Article: K95444512

---

611355 : tmm core with PEM

Component: Policy Enforcement Manager

Symptoms:
tmm cores intermittently on SIGSEGV.

Conditions:
A background job processing HA session information might rarely trigger this. No external factor is causing this.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
This release fixes the rarely encountered issue in which a background job processing HA session information might have triggered a tmm core.

---

610609-1 : Total connections in bigtop, SNMP are incorrect

Component: Local Traffic Manager

Symptoms:
While looking at total connections for the active BIG-IP using bigtop or SNMP, the connections are reported too high. For example if you sent a single connection through BIG-IP it is reported as 2 connections. Meanwhile, the standby device with mirroring configured accurately shows the number of connections.

Conditions:
This occurs on PVA-enabled hardware platforms.

Impact:
The total connection count statistic is incorrect.

---

610429-3 : X509::cert_fields iRule command may memory with subpubkey argument

Component: Local Traffic Manager

Symptoms:
The X509::cert_fields iRule command can leak memory in the 'method' memory subsystem if called with the 'subpubkey' argument, when the 'subpubkey' argument is not the last argument.

Conditions:
Create an iRule using X509::cert_fields where the subpubkey is not the last argument.

Example/signature to look for:
ltm rule rule_leak {
    when HTTP_REQUEST {
        if { [SSL::cert 0] ne "" } {
            HTTP::respond 200 content "[X509::cert_fields [SSL::cert 0] 0 subpubkey hash]\n"
        } else {
            HTTP::respond 200 content "no client cert (WRONG!)"
        }
    }
}

Impact:
Memory will leak, eventually impacting the operation of tmm.

Workaround:
Ensure that 'subpubkey' is the last argument to X509::cert_fields

---

610354-2 : TMM crash on invalid memory access to loopback interface stats object

Component: TMOS

Symptoms:
TMM can crash with segmentation fault when TMM drops packets on its internal loopback interface. TMM needs to update interface stats associated with the loopback interface when dropping packets on that interface. The interface stats object for loopback interface is not allocated yet. That results in segmentation fault.

Conditions:
TMM drops packets on its internal loopback interfaces.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
No Workaround.

---

610255-2 : CMI improvement

Solution Article: K62279530

---

610248 : IE 11 browser does not display VDI profile columns properly

Component: Access Policy Manager

Symptoms:
Microsoft Internet Explorer version 11 browsers do not properly display the two columns 'General information' and 'MSRDP settings' in the VDI profile edit window.

Conditions:
Using IE 11 browser, and APM is provisioned to use VDI profile.

Impact:
Makes it difficult to configure VDI profile using the GUI.

Workaround:
Use other browsers to configure VDI profile.

Fix:
Microsoft Internet Explorer version 11 browsers now properly display the two columns 'General information' and 'MSRDP settings' in the VDI profile edit window.

---

610243 : HTML5 access fails for Citrix Storefront integration mode with gateway pass through authentication

Component: Access Policy Manager

Symptoms:
HTML5 client can not be used to access the published applications or desktops.
HTML5 client access displays returns blank/black screen and displays "Can not connect to the server".

Conditions:
APM is configured Citrix Storefront integration mode. And in Storefront html5 client access is enabled.

Impact:
HTML5 client can not be used to access the published resources

Workaround:
None

Fix:
HTML5 client can be used to access the published resources.

---

610224-1 : APM client may fetch expired certificate when a valid and an expired certificate co-exist

Component: Access Policy Manager

Symptoms:
APM client does not consider the expiration when it matches certificates for Machine Cert Check. If a matching but expired certificate is found before a valid certificate, the expired certificate is used for Machine Cert Check on Windows.

Conditions:
A valid and an expired certificate co-exist in the certificate store.

Impact:
Machine Certificate check fails.

Workaround:
Remove the expired certificate from the store.

Fix:
When a valid and an expired certificate co-exist, the system now matches the valid certificate.

---

610180-3 : SAML Single Logout is misconfigured can cause a minor memory leak in SSO plugin.

Component: Access Policy Manager

Symptoms:
When BIG-IP is used as SAML SP, and SLO is not properly configured on associated saml-idp-connector objects, IdP initiated SAML SLO may result in memory leak in SSO plugin.

Conditions:
- BIG-IP is used as SP.
- Associated saml-idp-connector object has 'single-logout-uri' property configured, but 'single-logout-response-uri' property is empty.
- User performs IdP initiated SAML SLO

Impact:
SSO plugin leaks memory

Workaround:
There are two possible workarounds:
- Fix misconfiguration: Configure SLO correctly by adding value to 'single-logout-response-uri' property of IdP connector object.
- Disable SLO by removing single-logout-uri' property of IdP connector object.

Fix:
When fixed, memory will no longer leak in SSO plugin even when SLO is misconfigured.

---

609674-2 : machine certificate check creates issuer string with DC with reverse order

Solution Article: K38333488

Component: Access Policy Manager

Symptoms:
Machine certificate check on MAC creates issuer string with incorrect domain component (DC) order if it has any domain component in the certificate.
For example, if DC in certificate says f5net.com, issuer DC string should look like "DC=f5net, DC=com" but instead, it's in reverse order (DC="com", DC="f5net").

Conditions:
Machine certificate check configured on BIG-IP systems, certificate contains DC components.

Impact:
Machine certificate check might fail.

Workaround:
For access policies with machine certificate check targeted towards MAC, the order of DC should be reversed (compared to access policy with machine certificate check targeted towards Microsoft Windows) in the regex configured in machine certificate check.

Fix:
DC order evaluated by MAC is correctly ordered now and matches with that of Microsoft Windows.

Behavior Change:
Previously, machine certificate check on MAC creates issuer string with incorrect domain component (DC) order if it has any domain component in the certificate.
For example, if DC in certificate says f5net.com, issuer DC string should look like "DC=f5net, DC=com" but instead, it's in reverse order (DC="com", DC="f5net"). Now, DC order evaluated by MAC is correctly ordered now and matches with that of Microsoft Windows.

---

609496-1 : Improved diagnostics in BD config update (bd_agent) added

Component: Application Security Manager

Symptoms:
Improved diagnostics in BD config update (bd_agent) are needed.

Conditions:
Further troubleshooting of BD config update transmission is needed.

Impact:
No diagnostics are available.

Workaround:
None.

Fix:
Improved diagnostics in BD config update (bd_agent) were added.

---

609119-5 : Occasionally the logging system prints out a blank message: err mcpd[19114]: 01070711:3:

Component: TMOS

Symptoms:
Occasionally the logging system prints out a blank message, similar to the following example:

-- err mcpd[19114]: 01070711:3:

For this log statement, there is text associated with the error in the bigip_mcpd_error_defs.in file, so something should be logged.

Conditions:
The problem is the result of an exception handler issue in mcpd's File Object validator. The damaged logs can come from anywhere in mcpd, but appear only after a File Object configuration change fails validation. If the problem occurs, it will happen only once per validation error. The damage caused by the exception handler is automatically corrected when the system rewrites the log.

Impact:
Except for the missing log text, the state and behavior of the BIG-IP system is unaffected.

Workaround:
None. The problem corrects automatically when the system rewrites the log.

Fix:
The logging system prints out a blank message in response to failed file object configuration change validations.

---

609084-1 : Max number of chunks not configurable above 1000 chunks

Component: Application Security Manager

Symptoms:
If you want to support requests larger than 1000 chunks, the request is blocked and the system posts the following message in the ASM event log:

Unparsable request content Chunks number exceeds request chunks limit: 1000.

Conditions:
This occurs when the request exceeds 1000 chunks.

Impact:
Requests that are valid from the server side are being rejected.

Workaround:
None.

Fix:
This release adds an internal parameter "request_max_chunks_number" to enable configuring a greater than 1000 max number of chunks. The default value is 1000

Behavior Change:
This release adds an internal parameter "request_max_chunks_number" to enable configuring a greater than 1000 max number of chunks. The default value is 1000

---

608742-4 : DHCP: DHCP renew ack messages from server are getting dropped by BIGIP in Forward mode.

Component: Policy Enforcement Manager

Symptoms:
When BIGIP is configured in Forwarding mode, renewal ack message from server in response to unicast renewal message from DHCP clients is getting dropped.

Conditions:
BIG IP in forwarding mode. DHCP clients sending unicast renewal message to DHCP server

Impact:
Unicast DHCP renewal requests are not acked. DHCP clients will send broadcast renewal messages and will be acked by servers.

Workaround:
After unable to receive acks from DHCP servers for unicast DHCP renewal messages, DHCP client will send broadcast DHCP renewal messages and will be acked by DHCP server and acks forwarded by BIGIP and received by DHCP clients.

---

608551-4 : Half-closed congested SSL connections with unclean shutdown might stall.

Component: Local Traffic Manager

Symptoms:
Half-closed congested SSL connections with unclean shutdown might stall.

Conditions:
If SSL egress is congested and the client FINs with no Close Notify, connection might stall as SSL does not request more egress data from HTTP.

Impact:
Possible stalled flow.

Workaround:
Use SSL client that sends clean shutdown.

Fix:
Resolved half-closed congested SSL connections with unclean shutdown, so connections no longer stall.

---

608408-4 : TMM may restart if SSO plugin configuration initialization fails due to internal error in tmconf library

Component: Access Policy Manager

Symptoms:
TMM may restart when new SAML SSO configuration is created on BIG-IP systems as SAML IdP. This could also happen when BIG-IP is restarted, or a saved configuration containing SAML SSO objects is loaded on running BIG-IP.

Conditions:
All of the following
- The BIG-IP system is used as SAML IdP
- New SAML SSO configuration is added on BIG-IP
- Rarely occurring internal tmconf error happens when processing newly added configuration.

Impact:
TMM may restart.

Workaround:
None.

Fix:
TMM no longer restarts when internal error happens upon adding new SAML SSO configurations. Instead, the system logs the following error in /var/log/apm to indicate problematic configuration object: Internal error processing sso config <name>.

---

608320-4 : iControl REST API sets non-default persistence profile prop to "none"; properties not present in iControl REST API responseiControl REST API, sets persistence profile's non-default property value as "none"; properties missing in iControl REST API response

Component: TMOS

Symptoms:
For persistence profiles, iControl REST does not provide visibility for property override when "none" is specified, including references, passwords, and array of strings.

Conditions:
-- Use iControl REST API with persistence profiles.
-- string, enum, or vector of enum/string property explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf.

Impact:
The iControl REST API response skips these elements. iControl REST does not provide visibility for persistence profile property overrides.

Workaround:
None.

Fix:
iControl REST API now returns persistence profile elements (i.e., string, enum , or vector of enum/string property that is explicitly set to "none" for a component within any REST API endpoint specialized in /etc/icrd.conf) with a value "none". The exclusion to this policy is the secured attributes. Secured attributes are always excluded from the iControl REST API response.

---

607713-4 : SIP Parser fails header with multiple sequential separators inside quoted string.

Component: Service Provider

Symptoms:
SIP Parser fails header with multiple sequential separators inside quoted string.

Conditions:
If a SIP header contains multiple attribute separators ',' or ';' in an attribute.

Impact:
The SIP parser flags the message as an error. If this occurs in a quote within the attribute, it should be allowed, but it will still fail, Valid SIP messages are failing to be parsed.

Workaround:
None.

Fix:
The SIP parser has been improved to ignore multiple sequential separators if within quotes.

---

607360-2 : Safenet 6.2 library missing after upgrade★

Component: Local Traffic Manager

Symptoms:
After upgrading BIG-IP, a symbolic link is missing to the core Safenet library.

Conditions:
This occurs when a BIG-IP installation with Safenet 6.2 already installed is upgraded.

Impact:
Safenet 6.2 is not functional.

Workaround:
Reinstall Safenet 6.2. Or,

run this command at all blades of BIG-IP after the installation.

ln -sf /shared/safenet/toolkit/libgem.so /usr/lib64/openssl/engines/libgem.so

Fix:
Add symbolic link to libgem at time of pkcs11d daemon start/restart.

---

607314-3 : Oracle Java vulnerability CVE-2016-3500, CVE-2016-3508

Solution Article: K25075696

---

607304-2 : TMM is killed by SOD (missing heartbeat) during geoip_reload performing munmap.

Component: Local Traffic Manager

Symptoms:
TMM is killed by SOD (missing heartbeat) during geoip_reload performing munmap.

Conditions:
This can occur under normal operation, while running the geo_update command.

Impact:
Traffic disrupted while tmm restarts.

---

606575-3 : Request-oriented OneConnect load balancing ends when the server returns an error status code.

Component: Local Traffic Manager

Symptoms:
Request-oriented OneConnect load balancing ends when the server returns an error status code.

Conditions:
OneConnect is enabled and the server responds with a HTTP error status code.

Impact:
The client remains connected to the server, and no further load-balancing decisions are made.

Workaround:
It may be possible to detect the HTTP status code in the response, and manually detach the client-side.

To do so, use an iRule similar to the following:

when HTTP_RESPONSE {
    if { [HTTP::status] == 200 } { return }
    if { [HTTP::status] == 401 } {
        set auth_header [string tolower [HTTP::header values "WWW-Authenticate"]]
        if { $auth_header contains "negotiate" || $auth_header contains "ntlm" } {
            # Connection-oriented auth. System should already be doing the right thing
            unset auth_header
            return
        }

        unset auth_header
    }

    catch { ONECONNECT::detach enable }
}.

Note: These workarounds should not be used when the backend server is using connection-oriented HTTP authentication (e.g., NTLM or Negotiate authentication).

Fix:
With OneConnect, the client-side remains detachable when the server-side returns an HTTP error status code.

---

606540-1 : DB variable changed via GUI does not sync across HA group

Solution Article: K33064211

Component: TMOS

Symptoms:
If a configuration change is made in the BIG-IP GUI which is backed by a DB variable, the change is not synced to other devices in the same sync-failover device group.
If the same db variable change is made using the Traffic Management Shell (tmsh), the db variable change will be synced to other devices in the same sync-failover device group.

Note that db variable changes are never synced to devices in sync-only device groups.

Conditions:
1. BIG-IP systems in HA group, provisioned with modules (in addition to LTM) which create their own device groups (for example, ASM).
2. Original sync-failover device group replaced by a different sync-failover device group.
3. Using the GUI to change a configuration item which is backed by a DB variable.
Examples include:
failover.standby.linkdowntime (GUI: Device Management :: Device Groups : <fodg_name> : Failover : Link Down Time on Failover )
statemirror.clustermirroring (GUI: Device Management :: Devices : <device_name> : Cluster Options )

Impact:
Configuration of devices within a sync-failover device group may not be synchronized as expected.

Workaround:
To force synchronization of a db variable change made via the GUI, use a tmsh command of the following form:

tmsh modify cm device-group <sync-failover device group name> devices modify { <device name> { set-sync-leader } }

If the sync-failover device group is not automatically synced, manually sync the device group:

tmsh run cm config-sync to-group <sync-failover device group name>


To avoid creating a db variable change that will not be synchronized across sync-failover device group members, change the configuration or db variable using tmsh:

tmsh modify sys db <variable name> value <new value>

If the sync-failover device group is not automatically synced, manually sync the device group:

tmsh run cm config-sync to-group <sync-failover device group name>

Fix:
DB variable changed via GUI now syncs across HA group as expected.

---

605921 : scriptd and mcpd cores following multiple failovers due to bd (asm)

Component: Application Security Manager

Symptoms:
You encounter multiple failovers due to BD (asm) failure and mcpd coring. the GUI is sluggish, then bd becomes unresponsive or mcpd cores.

Conditions:
Apply policies on a device at the same time that it becomes the Master Blade.

Impact:
A deadlock condition can occur when policies are being applied at the same time as a change arrives in the cluster config.

Workaround:
None.

Fix:
Fixed a deadlock condition when applying policies.

---

605865-2 : Debug TMM produces core on certain ICMP PMTUD packets

Component: Local Traffic Manager

Symptoms:
The debug TMM will produce a core on the assert "cwnd or ssthresh too low" when receiving an ICMP PMTUD packet with an MTU larger than the current MTU. This does not affect the default TMM.

Conditions:
While using the debug TMM, an ICMP PMTUD packet is received with an MTU larger than the current MTU.

Impact:
Debug TMM crashes on assert "cwnd or ssthresh too low." Traffic disrupted while tmm restarts.

Workaround:
Block incoming ICMP PMTUD packets. Note that this will cause Path MTU Discovery to fail, and IP packets sent by the BIG-IP system with the Don't Fragment (DF) bit set may be dropped silently if the MTUs of the devices on the path are configured incorrectly.

Fix:
The system now always updates TCP MSS after an ICMP PMTUD packet, so there is no debug TMM core.

---

605616-3 : Creating 256 Fundamental Security policies will result in an out of memory error

Solution Article: K16221342

Component: Application Security Manager

Symptoms:
ASM out of memory error will occur when 256 fundamental security policies are created.

Conditions:
Create 256 fundamental security policies.

Impact:
Out of memory error.

Workaround:
None.

Fix:
Improved memory allocations for shared XML profiles to enable more than 256 fundamental security policies.

---

605476-2 : istatsd can core when reading corrupt stats files.

Component: TMOS

Symptoms:
-- The istatsd process produces a core file in the /shared/core directory.

Conditions:
This issue occurs when the following condition is met:

The istatsd process attempts to read a corrupt iStats segment file with duplicate FIDs.

Under these conditions, the istatsd process continually consumes memory which produces a core causing the istatsd process to restart.

Impact:
iStatsd process will restart due to resource exhaustion.

Workaround:
To work around this issue, you can remove the iStats files and restart the istatsd processes. To do so, perform the following procedure:

Impact of workaround: This workaround will cause all statistics in the iStats files to reset.

1. Log in to the BIG-IP command line.
2. To stop the istatsd and related processes, type the following command:
tmsh stop sys service istatsd avrd merged.

3. To delete the iStats files, type the following command:
find /var/tmstat2/ -depth -type f -delete.

4. To start the istatsd and related processes, type the following command:
tmsh start sys service istatsd avrd merged.

Fix:
Added a fix to protect against a continually reading a segment file that is corrupted and has Duplicate Fids.

---

605427-2 : TMM may crash when adding and removing virtual servers with security log profiles

Component: Advanced Firewall Manager

Symptoms:
In certain circumstances when virtual servers are configured with security log profiles TMM may crash.

Conditions:
Creation, modification and deletion of many virtual servers with security log profiles attached.

Impact:
TMM may crash with the following log in /var/log/tmm:
<13> Apr 18 13:23:04 <hostname> notice panic: ../base/fw_log_profile.c:3368: Assertion "fw_log_profile_protocol_sip_dos ref non-zero" failed.

Traffic disrupted while tmm restarts.

Fix:
TMM no longer crashes with multiple creation, modification and deletion of many virtual servers with security log profiles attached.

---

604977-3 : Wrong alert when DTLS cookie size is 32

Solution Article: K08905542

Component: Local Traffic Manager

Symptoms:
When ServerSSL profile using DTLS receives a cookie with length of 32 bytes, the system reports a fatal alert.

Conditions:
Another LTM with ClientSSL profile issues 32-byte long cookie.

Impact:
DTLS with cookie size 32-byte fails.

Workaround:
None.

Fix:
DTLS now accepts cookies with a length of 32 bytes.

---

604931-1 : bgpd might core on restarting process with BGP debug enabled.

Solution Article: K42028295

Component: TMOS

Symptoms:
On a BIG-IP system configured with dynamic routing using the BGP routing protocol, when BGP debugging is enabled, the bgpd daemon may crash.

Conditions:
- BGP configured and peering established.
- BGP debugging enabled.
- BGP process is restarted gracefully.

Impact:
bgpd may crash.

Workaround:
Disable BGP debug.

Fix:
The bgpd might core on restarting process with BGP debug enabled.

---

604923-3 : REST id for Signatures change after update

Component: Application Security Manager

Symptoms:
The REST id of existing signatures are unexpectedly modified after updating a User Defined Signature, or downloading an Attack Signature Update that modifies existing signatures.

Conditions:
A User-Defined Signature is updated, or an ASU containing updated signatures is downloaded.

Impact:
The REST id of the modified signatures is changed which may confuse REST clients.

Workaround:
Execution of the following script will repair an affected device:

perl -MF5::Utils::Rest -MF5::DbUtils -MF5::ASMConfig::Entity::Signature -e '$dbh = F5::DbUtils::get_dbh(); $dbh->begin_work(); $dbh->do("UPDATE PLC.NEGSIG_SIGNATURES SET rest_uuid = \"\" "); F5::Utils::Rest::populate_uuids(dbh => $dbh, rest_entities => ["F5::ASMConfig::Entity::Signature"]); $dbh->commit();'

Fix:
Updated Signatures now retain the correct REST id.

---

604767-4 : Importing SAML IdP's metadata on BIG-IP as SP may result in not complete configuration of IdP connector object.

Component: Access Policy Manager

Symptoms:
When importing SAML IdP's metadata, certificate object might not be assigned as 'idp-certificate' value of saml-idp-connector object.

Conditions:
BIG-IP is used as SAML SP.

Impact:
Described behavior will result in misconfiguration. SAML WebSSO will subsequently fail.

Workaround:
Manually assign imported certificate as a 'idp-certificate' value of saml-idp-connector object.

---

604496-2 : SQL (Oracle) monitor daemon might hang.

Component: Local Traffic Manager

Symptoms:
SQL (Oracle) monitor daemon might hang with high monitoring load (hundreds of monitors). DBDaemon debug log contains messages indicating hung connection aborting and that the address in use, unable to connect.

Conditions:
High number of SQL (Oracle, MSSQL, MySQL, PostgresSQL) monitors. Slow SQL responses might make the condition worse.

Impact:
Flapping pool members connected to SQL monitors. Frequent aborts and restarts of SQL monitor daemon.

Workaround:
You can mitigate this issue in the following ways:
-- Reduce number of monitored pool members.
-- Reduce frequency of monitor interval.
-- Split monitors among multiple devices.
-- Run monitors on bladed systems.

Fix:
This release fixes the address-in-use issue, and contains multiple monitor improvements to handle aborts and restarts of the SQL monitor daemon as well so that the system handles hung connections without aborting.

---

604442-1 : iControl log

Solution Article: K12685114

---

604223-1 : pkcs11d signal handler improvement to turn off all threads at time of "SIGTERM"

Component: Local Traffic Manager

Symptoms:
The current signal handler use 'exit' at time of 'SIGTERM'. This may result in a core under some abnormal situations.

Conditions:
When stopping pkcs11d using command like 'bigstart restart pkcs11d' or 'kill pkcs11d'.

Impact:
pkcs11d cores.

Workaround:
pkcs11d automatically comes up again after the core.

Fix:
The system now waits for all threads to finish before the pkcs11d program exits, so the core no longer occurs.

---

603945-1 : BD config update should be considered as config addition in case of update failure

Component: Application Security Manager

Symptoms:
A configuration update fails when the system cannot find the item to update. Configuration failures are shown in bd.log.

Conditions:
The condition that leads to this scenario is not clear and is still under investigation.

Impact:
The update fails and the entity is not added.

Workaround:
Delete the faulty entity and re-add, and then issue the following command: restart asm.

This fixes the issue in the cases in which it is a single entity.

Fix:
A configuration update no longer fails when the system cannot find the item to update. Now, the system adds the item with its updated value if the entity does not already exist. Otherwise, the operation updates the value of the existing entry.

---

603667-3 : TMM may leak or corrupt memory when configuration changes occur with plugins in use

Component: Local Traffic Manager

Symptoms:
TMM may leak memory when plugins are in use and the plugin is re-initialized (typically due to configuration changes). In rare cases, memory corruption may occur causing TMM to restart.

Conditions:
Plugin-based functionality configured (ASM, APM, etc.) and configuration changes occur.

Impact:
The memory leakage generally occurs infrequently and at a rate that TMM operations are not affected. However, when memory corruption occurs, a traffic interruption may occur due to TMM restarting.

Workaround:
No workaround except disabling plugin-based functionality (such as ASM, APM, etc.).

Fix:
TMM now properly manages plugin memory, and no longer leaks or corrupts this memory.

---

603606 : tmm core

Component: Local Traffic Manager

Symptoms:
A tmm core occurrs with the following log message: notice panic: ../kern/page_alloc.c:521: Assertion "vmem_hashlist_remove not found" failed.

Conditions:
It is not known exactly what triggers this condition.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

---

603598-2 : big3d memory under extreme load conditions

Component: Global Traffic Manager

Symptoms:
big3d memory consumption can grow if big3d is unable to process monitor requests in a timely fashion.

This can be seen by monitoring the memory consumption of big3d using standard OS tools such as top.

Conditions:
big3d maintains a queue for monitor requests.
Incoming monitor requests are first placed in the Pending queue.
Requests are moved from the Pending queue to the Active queue, if there is room in the Active queue.

When the Pending queue is full, there is no room for the Monitor Request. big3d attempts to clean up the Monitor request, but fails to completely free the memory.
This might result in a significant memory leak.

For this to happen, the Active queue must be full as well as the Pending queue.

One possible condition that might cause this is if multiple Monitors time out. This results in Monitors having long life times, which keeps the Active queue full.

Thus the Pending queue might become full and the memory leak can occur.

In BIG-IP 11.1.0 versions of big3d,
the Active queue has 256 slots and
the Pending queue has 4096 slots.

In BIG-IP 11.1.0-hf3, the queue sizes were expanded to
2048 for the Active queue and 16384 for the Pending queue.

Since the queues were smaller n versions prior to
11.1.0-hf3, this leaks is more likely to manifest itself.

In later versions, the leak is still possible, but is less likely to occur.

Impact:
big3d memory consumption grows unbounded. This might result in a big3d restart or memory starvation of other processes.

Workaround:
This can be partially mitigated by ensuring that monitors
settings are reasonable and that big3d is not overloaded.

This will minimize the chances that the Pending queue
does not become full.

There is no mechanism to resize the queues.

Fix:
When a monitor request is unable to be placed in the queue, the memory for the request is freed properly.

---

603479-1 : "ASM starting" while it's already running, causing the restart of all ASM daemons

Component: Application Security Manager

Symptoms:
ASM daemons suddenly restart, w/ the message "ASM Starting" in '/var/log/asm', while ASM is already running and without ASM stopping first.

Conditions:
Unknown

Impact:
ASM daemons restart

Workaround:
N/A

Fix:
We have prevented the ASM start script from being executed if it is already running.
Thus, preventing the possibility of a spurious ASM Start while it's already running.

---

603293-3 : Incorrect handling of L4 Dynamic ACL when it is processed together with L7 ACLs

Component: Access Policy Manager

Symptoms:
L4 Dynamic ACL is not applied to incoming traffic when assigned in combination with L7 ACL.

Conditions:
APM supports a combination of L7 ACL and L4 ACL to be assigned to one session. When L7 ACLs are assigned with higher priority than L4 ACLs, the processing of L4 ACLs is automatically deferred until L7 information is available. The issue here is that when none of L7 ACLs with higher priority match with the traffic, L4 ACL is incorrectly marked to be applied only to HTTP traffic. Therefore if the incoming traffic is not HTTP, for example, HTTPS, then this particular dynamic L4 ACL is bypassed.

Impact:
L4 Dynamic ACL is not applied correctly.

Workaround:
Reorder L4 ACLs with higher priority than L7 ACLs, if possible, or to prevent the issue from occurring, avoid assigning L7 ACLs if not needed.

Fix:
When L7 ACL is assigned in combination to L4 Dynamic ACL, L4 Dynamic ACL is correctly applied to all kinds of traffic, not only HTTP traffic.

---

603236-2 : 1024 and 4096 size key creation issue with SafeNet 6.2 with 6.10.9 firmware

Component: Local Traffic Manager

Symptoms:
Creating 1024 and 4096 size keys fail when the SafeNet client version installed on BIG-IP is 6.2 and SafeNet appliance firmware is 6.10.9.

Conditions:
-- SafeNet appliance: 6.2.
-- SafeNet client: 6.2.
-- SafeNet firmware: 6.10.9.

Impact:
Cannot create 1024 or 4096 size RSA keys.

Workaround:
None.

Fix:
Removed the config line, RSAKeyGenMechRemap = 1, that was conflicting with 6.10.9 firmware.

---

603149-1 : Large ike-phase2-lifetime-kilobytes values in racoon ipsec-policy

Component: TMOS

Symptoms:
Setting max data limit transmitted (in kilobytes) to a very large limit results in a smaller limit, causing SAs to expire too quickly. Values for ike-phase2-lifetime-kilobytes inside ipsec-policy can reach 2^32-1 kilobytes, but will be processed incorrectly, as if the value were smaller.

Conditions:
When lifetime-kilobytes is large enough, it can act as though it were smaller.

Impact:
Negotiated SAs expire too quickly when size lifetime is calculated too small.

Workaround:
Before the fix, decrease lifetime-kilobytes until properly stable.

Fix:
The fix should make every value no more than 4294967295 kilobytes work correctly, without becoming some smaller value. (Note this value is 2^32-1.) If the size of ike-phase2-lifetime-kilobytes becomes 64-bit in the future, this will also work, causing a 64-bit value for kilobytes to occur in isakmp negotiation.

---

603082-2 : Ephemeral pool members are getting deleted/created over and over again.

Component: Local Traffic Manager

Symptoms:
When fqdn nodes are configured, you may see ephemeral pool members getting created and deleted continuously. In severe cases, this can cause mcpd to run out of memory and crash.

Conditions:
It is not known exactly what triggers this condition, but it has been observed after running bigstart restart in a configuration containing many fqdn nodes.

Impact:
Traffic disrupted while mcpd restarts.

---

603071-1 : XHTML validation fails on obfuscated JavaScript

Component: Application Security Manager

Symptoms:
The obfuscated JavaScript injected by ASM for CSRF protection and other features causes web pages to fail w3c validation.

Conditions:
CSRF or WebScrapping enabled in ASM policy

Impact:
Threre is no end user impact, but if checking the page with w3c online validator it returns errors

Workaround:
N/A

Fix:
Wrapped the script in CDATA - the validator will not complain on errors.

---

603032-2 : clientssl profiles with sni-default enabled may leak X509 objects

Component: Local Traffic Manager

Symptoms:
SSL memory consumption grows when virtuals with sni-default-enabled clientssl profiles are modified.

Conditions:
clientssl profile with sni-default enabled combined with configuration manipulations of virtuals with such profiles.

Impact:
The amount of leakage will depending on the number of virtuals with sni-default-enabled clientssl profiles and frequency of configuration manipulations. For large configurations, the leakage can be very noticeable over time.

Workaround:
No workaround short of not using sni-default.

Fix:
SSL now handles sni-default-enabled clientssl profiles without leaking the X509 objects.

---

602654-3 : TMM crash when using AVR lookups

Component: Application Visibility and Reporting

Symptoms:
When trying to find/insert data into AVR lookups TMM/AVR core might occur.

Conditions:
AVR lookups in use.

Impact:
tmm crashes. The crash occur when two processes simultaneously try to access the same cell in the lookup. Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
TMM no longer crashes when using AVR lookups.

---

602366-2 : Safenet 6.2 HA performance

Component: Local Traffic Manager

Symptoms:
With Safenet 6.2 HA setup, you only sees the performance of one HSM.

Conditions:
Safenet 6.2 client is installed and Safenet HA is used.

Impact:
Only one HSM is used for the HA setup.

Workaround:
Add primary hsm to the newly created ha group
/shared/safenet/lunasa/bin/lunacm -c hagroup createGroup -serialNumber 464683014 -label ha_test -password <pw>

or
echo "copy" | /shared/safenet/lunasa/bin/lunacm -c hagroup createGroup -serialNumber 464683014 -label ha_test -password <pw>

Add following hsm to the ha group
/shared/safenet/lunasa/bin/lunacm -c hagroup addMember -serialNumber 470379014 -group ha_test -password <pw>

Enable HAonly
/shared/safenet/lunasa/bin/lunacm -c hagroup HAOnly -enable

Delete ha group
/shared/safenet/lunasa/bin/lunacm -c hagroup deleteGroup -label ha_test

Fix:
Installation script is updated for Safenet 6.2 HA.

---

602358-2 : BIG-IP ServerSSL connection may reset during rengotiation with some SSL/TLS servers due to ClientHello version

Component: Local Traffic Manager

Symptoms:
During SSL/TLS renegotiation, the TLS standard requires that the new ClientHello version matches the first session.

Usually, SSL/TLS servers require the new ClientHello version to match the previous negotiated (ServerHello) version. The BIG-IP ServerSSL default behavior is to match this requirement.

The problem occurs if the SSL/TLS server requires the ClientHello (both in the Record layer and Handshake Protocol) in the new ClientHello to be exactly the same as the SSL/TLS version of the first ClientHello; that is:
************************************************************
1st ClientHello record layer version == 2nd ClientHello record layer version;
1st ClientHello Handshake Protocol version == 2nd ClientHello Handshake Protocol version.
************************************************************
As a result, the SSL/TLS server will reject the renegotiation handshake, causing the connection to terminate.

Conditions:
This occurs when using virtual servers configured with one or more ServerSSL profiles, and an SSL/TLS renegotiation occurs, and the server requires the new ClientHello version to match the first ClientHello instead of the previous ServerHello version.

Impact:
SSL/TLS renegotiation between BIG-IP ServerSSL profile and server may fail, resulting in an unexpected connection close or reset.

Workaround:
Manually setting the ciphers in the ServerSSL to TLS1.0 can solve the issue.

Fix:
A new db variable called ssl.RenegotiateWithInitialClientHello has been added to control the SSL/TLS version in the 2nd ClientHello:

1. The default is disable, which means that the 2nd ClientHello SSL/TLS version will be set to the negotiated version in the 1st round ServerHello.

2. If it is set to enable, both ClientHello versions will be exactly the same.

---

602221-3 : Wrong parsing of redirect Domain

Component: Application Security Manager

Symptoms:
ASM learns wrong domain names

Conditions:
no '/' after domain name in the redirect domain

Impact:
wrong learning suggestion can lead to wrong policy

Workaround:
N/A

Fix:
Fixing an issue with parsing the URL in the location header

---

601938-3 : MCPD stores certain data incorrectly

Solution Article: K52180214

---

601927-3 : Security hardening of control plane

Solution Article: K52180214

Component: TMOS

Symptoms:
File permissions changes needed as found by internal testing

Conditions:
N/A

Impact:
N/A

Fix:
Apply latest security practices to control plane files.

---

601905-4 : POST requests may not be forwarded to backend server when EAM plugin is enabled on the virtual server

Component: Access Policy Manager

Symptoms:
POST requests appear to hang when they are sent through a virtual server with EAM plugin enabled.

Conditions:
Most likely, the POST request contains large post data.

Impact:
The POST request will fail.

Workaround:
The following iRule will workaround the issue:

 when HTTP_REQUEST {

  if {[HTTP::method] eq "POST"}{
    # Trigger collection for up to $max_collect of data
    set max_collect 1000000
    if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= $max_collect}{
      set content_length [HTTP::header "Content-Length"]
    } else {
        set content_length $max_collect
    }
    # Check if $content_length is not set to 0
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
  }

---

601527-3 : mcpd memory leak and core

Component: TMOS

Symptoms:
Mcpd can leak memory during config update or config sync.

Conditions:
All of the conditions that trigger this are not known but it seems to occur during full configuration sync and is most severe on the config sync peers. It was triggered making a single change on the primary by configuring a monitor rule, e.g., tmsh create ltm pool p members { 1.2.3.4:80 } monitor http

Impact:
Loss of memory over time, which may result in out-of-memory and mcpd core.

Fix:
Fixed a memory lean in mcpd

---

601502-1 : Excessive OCSP traffic

Component: TMOS

Symptoms:
With OCSP configured on a virtual server, you see excessive OCSP requests going to the OCSP server.

Conditions:
Virtual server configured with an OCSP profile

Impact:
OCSP responses are not cached properly and excessive requests are sent to the server.

Workaround:
None.

Fix:
OCSP responses are now cached properly, so excessive requests are no longer sent to the server.

---

601496-1 : iRules and OCSP Stapling

Component: Local Traffic Manager

Symptoms:
Using certain iRules on virtual servers with OCSP Stapling enabled on the Client SSL profile might cause OCSP requests to be reissued, resulting in a memory leak.

You may notice warning messages similar to the following in /var/log/ltm:
warning tmm[11300]: 011e0003:4: Aggressive mode sweeper: /Common/default-eviction-policy (0) (global memory) 115 Connections killed.

Conditions:
This occurs when the following conditions are met:
-- Virtual server with OCSP Stabling enabled.
-- iRule attached to the virtual server that uses SSL::renegotiate.

Impact:
TMM memory used increases gradually, eventually the aggressive mode sweeper is activated.

Workaround:
None.

Fix:
Using certain iRules on virtual servers with OCSP Stapling enabled on the Client SSL profile no longer causes OCSP requests to be reissued, so there is no associated memory leak.

---

601420-2 : Possible SAML authentication loop with IE and multi-domain SSO.

Component: Access Policy Manager

Symptoms:
When APM is configured with SAML authentication and multi-domain SSO, Internet Explorer may encounter authentication loop and never complete the access policy.

Conditions:
APM is configured with SAML authentication and multi-domain SSO.

Impact:
Using Internet Explorer, the client may not be unable to connect to its desired destination.

Workaround:
Chrome and Firefox do not seem to be affected.

Fix:
Use cookie for session for multi-domain if TOKEN lookup fails. Previously, the cookie was ignored for multi-domain response URI. However, with the introduction of TOKEN based session lookup, this causes a failure if the client retries the request (since the TOKEN was consumed in the request prior to the retry).

---

601255-3 : RTSP response to SETUP request has incorrect client_port attribute

Component: Service Provider

Symptoms:
- Clientside data is sent to UDP port 0
- RTSP response to SETUP request contains incorrect 'client_port' attribute (0)

Conditions:
- Virtual with RTSP profile.
- 200/OK is received from server in response to the initial SETUP request
- SETUP request was the initial message received on a new connection

Impact:
Unicast media may forwarded to incorrect UDP port (0).

Fix:
Initialize 'client_port' attribute to value received from server when re-writing response to client.

---

601180-1 : Link Controller base license does not allow DNS namespace iRule commands.★

Solution Article: K73505027

Component: Global Traffic Manager

Symptoms:
The Link Controller base license improperly prevents DNS namespace iRule commands.

Conditions:
A Link Controller license without an add-on that allows Layer 7 iRule commands.

Impact:
An administrator cannot add DNS namespace commands to an iRule. Cannot upgrade from a pre-11.5 configuration, where the commands were working, to 11.5.4 through 12.1.2.

Workaround:
To enable upgrade, remove DNS namespace commands from the configuration prior to upgrade.

Fix:
DNS namespace iRule commands are now properly accepted with a Link Controller base license.

---

601178-3 : HTTP cookie persistence 'preferred' encryption

Component: Local Traffic Manager

Symptoms:
When encryption is 'preferred' in the http cookie persistence profile, when the client presents a plain-text route domain formatted cookie the BIG-IP will ignore the cookie and re-load balance the connection.

Conditions:
This occurs when route-domain-compatible cookies are sent in plaintext.

Impact:
Cookie does not get accepted by the persistence profile and flow does not persist.

---

600982-1 : TMM crashes at ssl_cache_sid() with "prf->cache.sid == 0"

Component: Local Traffic Manager

Symptoms:
When SSL is configured, the TMM might rarely crash, logging the following error in /var/log/ltm: notice panic: ../modules/hudfilter/ssl/ssl_session.c:538: Assertion "cached" failed.

Conditions:
No conditions to be set, however this is a very rare occurrence in which a random number generator can technically generate the number Zero ( 0 ) which would trigger this.

Impact:
Traffic disrupted while TMM restarts, and failover occurs if high availability is configured. Mirroring and LB may be lost with renegotiation for certain types of traffic.

Workaround:
None.

Fix:
When SSL is configured, the TMM no longer intermittently crashes with the message: Assertion "cached" failed.

---

600827-5 : Stuck nitrox crypto queue can erroneously be reported

Component: Local Traffic Manager

Symptoms:
In some cases, a stuck crypto queue can be erroneously detected on Nitrox systems (Nitrox PX and Nitrox 3). When the tmm/crypto stats are examined, they show no queued requests. The message "Hardware Error(Co-Processor): n3-crypto0 request queue stuck" will appear in the ltm log file.

Conditions:
Nitrox based system performing SSL under heavy load.

Impact:
Device errors reported in logs and crypto HA action is taken, possibly resulting in failing over.

Fix:
The Nitrox crypto driver uses a proper timeout value for crypto requests.

---

600662-4 : NAT64 vulnerability CVE-2016-5745

Solution Article: K64743453

---

600593-4 : Use of HTTP Explicit Proxy and OneConnect can lead to an issue with CONNECT HTTP requests

Component: Local Traffic Manager

Symptoms:
After a CONNECT request is sent to the BIG-IP system and processed, if the client disconnects before a response is received from the server, the FIN is not propagated to the server-side and that connection remains open. If a client sends another CONNECT request to the same destination, the previous server-side flow is reused for the new request. Inspection of packet captures reveals that the BIG-IP system does not process the new CONNECT request as such, but instead forwards it to the server using the old server-side flow. This behaviour is incorrect. The CONNECT method should disable connection reuse, and the BIG-IP should close the server-side flow if the client disconnects first.

Conditions:
Use of HTTP Explicit Proxy and OneConnect together. CONNECT requests must arrive to the virtual server. The client must disconnect before the server responds.

Impact:
Some connections may fail. Depending on what data is sent to the server over an unintended connection, unpredictable results may be experienced.

Workaround:
You can apply the following iRule to the HTTP Explicit Proxy virtual server to mitigate the issue:

when HTTP_PROXY_REQUEST {
   if { [HTTP::method] equals "CONNECT" } {
      ONECONNECT::reuse disable
   }
   else {
      ONECONNECT::reuse enable
   }
}

---

600558-3 : Errors logged after deleting user in GUI

Component: TMOS

Symptoms:
After deleting a user in the BIG-IP GUI (under Access Policy :: Local User DB : Manage Users), the following symptoms may be observed:

1. After approximately 10 minutes, an error similar to the following appears in the LTM log (/var/log/ltm):

mcpd[25939]: 01070418:5: connection 0x5dde19c8 (user admin) was closed with active requests

This message may also appear in /var/log/webui.log and /var/log/tomcat/catalina.out.

2. After clicking Refresh, the GUI may not show the correct web page.

Conditions:
This has been reported most frequently when deleting local users (Access Policy :: Local User DB : Manage Users), but has been encountered in other ways. The issue might require deleting a user and then remaining on the Manage Users page until an internal timeout of approximately 10 minutes passes.

Impact:
Error messages logged.
GUI may not show the correct web page.

Workaround:
Use the CLI (tmsh) to delete local users.

Fix:
Errors are no longer logged after deleting user in GUI.

---

600535 : TMM may core while exiting if MCPD connection was previously aborted

Component: Local Traffic Manager

Symptoms:
TMM cores while exiting after MCPD has spontaneously restarted.

Conditions:
MCPD aborts connection to TMM, typically due to fatal internal configuration errors causing MCPD to exit. This is generally a rarely occurring issue.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
This issue has no workaround at this time.

Fix:
TMM no longer cores when exiting.

---

600232-4 : OpenSSL vulnerability CVE-2016-2177

Solution Article: K23873366

---

600223-4 : OpenSSL vulnerability CVE-2016-2177

Solution Article: K23873366

---

600205-4 : OpenSSL Vulnerability: CVE-2016-2178

Solution Article: K53084033

---

600198-4 : OpenSSL vulnerability CVE-2016-2178

Solution Article: K53084033

---

600174-1 : Wildcard "*" redirection domain cannot be deleted if list is scrollable

Component: Application Security Manager

Symptoms:
Wildcard "*" redirection domain cannot be deleted if list is scrollable

Conditions:
Add redirection domains until list becomes scrollable (at least 4 or 5)

Impact:
first redirection domain in the list cannot be deleted

Workaround:
first delete redirection domains (not first one) to make list not scrollable, then re-add again

Fix:
Any redirection domain can be removed from the list

---

600116-1 : DNS resolution request may take a long time in some cases

Component: Access Policy Manager

Symptoms:
DNS resolution may appear slow in some cases

Conditions:
All of following conditions should be met

1) DNS Relay proxy is installed on user's machine
2) User's machine has multiple network adapters and some of them are in disconnected state.

Impact:
DNS resolution will be slow

Workaround:
Disable network adapters that are not connected.

Fix:
Now DNS Relay proxy server doesn't proxy DNS servers on non-connected interfaces. This fixes slow resolution DNS issue.

---

600069-3 : Portal Access: Requests handled incorrectly

Component: Access Policy Manager

Symptoms:
In some cases Portal Access requests do not return the intended resource.

Conditions:
Portal Access configured

Impact:
In some cases Portal Access requests do not return the intended resource.

Fix:
Improve Portal Access request processing

---

599536-2 : IPsec peer with wildcard selector brings up wrong phase2 SAs

Component: TMOS

Symptoms:
If a remote IPsec peer sends a wildcard (0.0.0.0/0 <-> 0.0.0.0/0) traffic-selector in phase2, the BIG-IP system will find a match against a non-wildcard selector and use that policy to complete phase2 negotiation.

You may encounter this problem if you have one or more remote peers attempting to negotiate phase2 with wildcard traffic-selectors. An IPsec tunnel may start but fail to pass data and at the same time another IPsec tunnel may stop working.

Conditions:
The remote IPsec peer sends a wildcard (0.0.0.0/0 <-> 0.0.0.0/0) traffic-selector in phase2. Phase1 must be established first.

Impact:
A tunnel will start, but data communication (over ESP or AH) will fail.
Other tunnels may be subject to an accidental DOS when a peer establishes phase1 but uses wildcard traffic-selectors in phase2. A traffic-selector matched by wildcard might be bound to a tunnel already in use, which is then taken offline by the new Security Associations.

Fix:
Ensure that phase2 negotiation using a wildcard (0.0.0.0/0 <-> 0.0.0.0/0) traffic-selector does not establish a Security Association with an ipsec-policy associated with a non-wildcard traffic-selector.

Behavior Change:
Previously, a wildcard selector was able to match a non-wildcard selector, and thus engage the wrong (IPsec) tunnel to attempt negotiation, usually failing.

In effect, a wildcard selector was able to bind to the wrong peer; but after this change only the right peer should bind. This cleans up behavior of selector as identity key, and prevents subjecting random wrong peers from noise.

---

599521-2 : Persistence entries not added if message is routed via an iRule

Component: Service Provider

Symptoms:
MRF SIP route table implementation does not add a persistence entry if the message was routed via an iRule.

Conditions:
If the message is routed via an iRule, a SIP persistence entry will not be created.

Impact:
Since MRF SIP persistence may be bidirectional, not having the persistence entry will keep message flowing in the opposite direction from being automatically routed via persistence.

Workaround:
An iRule could be used to route messages directed towards the original client.

Fix:
MRF SIP will add a persistence entry for message routed via an iRule.

---

599285-4 : PHP vulnerabilities CVE-2016-5094 and CVE-2016-5095

Solution Article: K51390683

---

599168-4 : BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700

Solution Article: K35520031

---

598983-4 : BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2016-5700

Solution Article: K35520031

---

598981-2 : APM ACL does not get enforced all the time under certain conditions

Solution Article: K06913155

Component: Access Policy Manager

Symptoms:
APM ACL does not get enforced all the time under certain conditions

Conditions:
The following conditions individually increase the chances for this problem to occur:
1. The device is very busy. (Construction of ACL windows is prolonged.)
2. Concentration of connections into one TMM. (e.g., VPN feature.)
3. Small number of TMMs (e.g., BIG-IP low-end platform, Virtual Edition (VE) configurations.)
4. Application starts with a high number of concurrent connections.

Impact:
ACL is not applied for subsequent connections for that TMM. This issue does not consistently reproduce.

Workaround:
Mitigation:
Administrator can kill the affected session, which forces the user to re-login, and ultimately restarts the ACL construction process.

Fix:
Switching context when applying ACL is properly processed, and no longer cause ACL to be not enforced.

---

598909-1 : SQL produces errors. AVR does not display any statistics.

Component: Application Visibility and Reporting

Symptoms:
SQL produces errors. AVR does not display any statistics. AFM, APM, ASM, AVR, FPS and SWG might be non-functional.

Conditions:
In version 11.6.0 and 11.6.1, there is an issue that occurs intermittently during software build operations.

Impact:
SQL produces errors. AVR does not display any statistics.

Workaround:
If occurs:
1. Edit file /var/avr/avr_srv_code.sql.
2. Make sure that the following text starts in a new line:
   '# Old tables (for DB upgrade only)'
3. touch /var/avr/init_avrdb.
4. Restart the Monpd daemon: bigstart restart monpd.

Fix:
SQL no longer produces errors in response to an intermittent issue that occurred during software build operations.

---

598874-3 : GTM Resolver sends FIN after SYN retransmission timeout

Component: Local Traffic Manager

Symptoms:
If a DNS server is not responding to TCP SYN, GTM Resolver sends a FIN after a retransmission timeout (RTO) of the SYN.

Conditions:
GTM Resolver tries to open a TCP connection to a server that does not respond.

Impact:
Firewalls may log the FIN as a possible attack.

Fix:
Do not send anything in response to a SYN retransmission timeout.

---

598854-1 : sipdb tool incorrectly displays persistence records without a pool name

Component: Service Provider

Symptoms:
MRF SIP persistence records added for a forwarding route (a peer object without a pool), will not be displayed properly by sipdb

Conditions:
If a persistence record is added for a route that does not contain a pool, this persistence entry will not be displayed correctly.

Impact:
The persistence entry is correctly stored in the persistence table and will operate correctly. Due to the bug in the sipdb tool, this entry will not be viewable for debugging purposes.

Fix:
The fix corrects the sipdb tool so that entries which do not have a pool name will display correctly.

---

598498-4 : Cannot remove Self IP when an unrelated static ARP entry exists.

Component: TMOS

Symptoms:
Cannot remove a self-IP when an unrelated static ARP entry exists. The system produces an error similar to the following: err mcpd[6743]: 01071907:3: Cannot delete IP <addr> because it would leave a static neighbor (ARP/NDP) entry unreachable.

Conditions:
Static arp entry exists, and there are no Self IP addresses on the same subnet as the static ARP entry. When in this condition, none of the Self IP addresses can be deleted.

Impact:
Must delete static ARP entries in order to delete Self IP addresses.

Workaround:
None.

Fix:
In this release, you can delete Self IP addresses if unrelated static ARP entries exist.

---

598211-2 : Citrix Android Receiver 3.9 does not work through APM in StoreFront integration mode.

Component: Access Policy Manager

Symptoms:
During the logon to Citrix StoreFront through an APM virtual server, after the login page, the BIG-IP system sends the client the following error: Error 404 file or directory not found.

Conditions:
This occurs when the following conditions are met:
- Citrix Android receiver 3.9.
- APM is in integration mode with Citrix StoreFront.
- Storefront unified experience mode is enabled.

Impact:
Cannot access Citrix StoreFront unified UI through Android Receiver 3.9.

Workaround:
For StoreFront integration mode, there is an iRule that is created by the iApp that redirects the root page to the store's URI. The workaround is to add an additional redirect for the receiver_uri ending with receiver.html. The iRule below contains this workaround.
It is also recommended to delete and recreate the existing store account.

when HTTP_REQUEST {
    if { [regexp -nocase {/citrix/(.+)/receiver\.html} [HTTP::path] dummy store_name] } {
        log -noname accesscontrol.local1.debug "01490000:7: setting http path to /Citrix/$store_name/"
        HTTP::path "/Citrix/$store_name/"
    }
}

Fix:
Citrix Android Receiver 3.9 now works through APM in StoreFront integration mode.

---

598039-3 : MCP memory may leak when performing a wildcard query

Component: TMOS

Symptoms:
MCP's umem_alloc_80 cache (visible using tmctl -a) increases in size after certain wildcard queries. Accordingly, the MCP process shows increased memory usage.

Conditions:
Folders must be in use, and the user must execute a wildcard query for objects that are in the upper levels of the folder hierarchy (i.e. not at the very bottom of the folder tree).

Impact:
MCP loses available memory with each query. MCP could eventually run out of memory and core, resulting in an outage or failover (depending on whether or not the customer is running in a device cluster).

Workaround:
Do not perform wildcard queries.

Fix:
Stopped MCP leaking when wildcard queries are performed.

---

598002-3 : OpenSSL vulnerability CVE-2016-2178

Solution Article: K53084033

---

597978-4 : GARPs may be transmitted by active going offline

Component: Local Traffic Manager

Symptoms:
GARPs may be transmitted by the active when going offline. As the standby which takes over for the active will also transmit GARPs, it is not expected that this will cause impact.

Conditions:
Multiple traffic-groups configured and active goes offline.

Impact:
It is not expected that this will cause any impact.

Workaround:
Make the unit standby before forcing offline.

---

597966 : ARP/neighbor cache nexthop object can be freed while still referenced by another structure

Component: Local Traffic Manager

Symptoms:
Use after free or double-free of the nexthop object may cause memory corruption or TMM core.

Conditions:
This can happen if the server-side connection establishment takes some time to complete, creating a large enough time window where the nexthop object might be freed.

Impact:
The BIG-IP dataplane might crash. This is a very timing/memory-usage-dependent issue.

Workaround:
None.

Fix:
Management of nexthop object reference counting is more consistent.

---

597835-1 : Branch parameter in inserted VIA header not consistent as per spec

Component: Service Provider

Symptoms:
MRF SIP in LoadBalancing Operation Mode inserts a VIA header to SIP request messages. This VIA header is removed from the returned response message. The VIA header contains encrypted routing information to route the response message. The SIP spec states that all messages in the same transaction should contain the same branch header. The code used to encrypt the branch field returns a different value each time.

Conditions:
Enabling SIP Via header insertion on the BIGIP on SIP MRF profile and need to cancel an INVITE

Impact:
Some servers have code to verify the brach fields in the VIA header do not change within a transaction. These servers complain when they see the fields change.

Fix:
The code has been improved to ensure the branch field in the via header does not change.

---

597729-1 : Errors logged after deleting user in GUI

Component: TMOS

Symptoms:
After deleting a user in the BIG-IP GUI (under Access Policy :: Local User DB : Manage Users), the following symptoms may potentially be observed:

1. After approximately 10 minutes, an error similar to the following may appear in the LTM log (/var/log/ltm):

mcpd[25939]: 01070418:5: connection 0x5dde19c8 (user admin) was closed with active requests

Such message may also appear in /var/log/webui.log and /var/log/tomcat/catalina.out.

2. After clicking Refresh, the GUI may not show the correct web page.

Conditions:
It is possible that this error could be encountered when deleting local users (Access Policy :: Local User DB : Manage Users), and may theoretically be encountered in other ways. The issue might require deleting a user and then remaining on the Manage Users page until an internal timeout of approximately 10 minutes passes.

Impact:
Error messages logged.
GUI may not show the correct web page.

Workaround:
Use the CLI (tmsh) to delete local users.

---

597601-4 : Improvement for a previous issue regressed NAT-T

Component: TMOS

Symptoms:
An earlier improvement request regressed NAT-T whereby phase2 cannot establish.

Conditions:
Using NAT-T with IKEv1.

Impact:
NAT-T does not work.

Fix:
NAT-T is now working after fixing the issue introduced in the improvement.

---

597431-4 : VPN establishment may fail when computer wakes up from sleep

Component: Access Policy Manager

Symptoms:
EdgeClient doesn't cleanup routing table before windows goes to hibernate. This may result in establishment of VPN when computer wakes up. It may also result in other network connectivity issues

Conditions:
-VPN connection is not disconnected
-Computer goes in hibernation

Impact:
Issues with Network connectivity

Workaround:
Renew DHCP lease by running
ipconfig/renew.

or

reboot the machine.

---

597394-1 : Improper handling of IP options

Solution Article: K46535047

---

597214-2 : Portal Access / JavaScript code which uses reserved keywords for field names in literal object definition may not work correctly

Component: Access Policy Manager

Symptoms:
JavaScript code with literal object definition containing field names equal to reserved keywords is not handled correctly by Portal Access.

Conditions:
JavaScript code with literal object definition containing fields with reserved keywords as a name, for example:

var a = { default: 1, continue: 2 };

Impact:
JavaScript code is not rewritten and may not work correctly.

Workaround:
It is possible to use iRule to rename field names in original code.

Fix:
Now JavaScript with literal object definition containing reserved keywords as field names is handled correctly by Portal Access.

---

597089-5 : Connections are terminated after 5 seconds when using ePVA full acceleration

Component: Local Traffic Manager

Symptoms:
When using a fast L4 profile with ePVA full acceleration configured, the 5-second TCP 3WHS handshake timeout is not being updated to the TCP idle timeout after the handshake is completed. The symptom is an unusually high number of connections getting reset in a short period of time.

Conditions:
It is not known all of the conditions that trigger this, but it is seen when using the fast L4 profile with pva-acceleration set to full.

Impact:
High number of connections get reset, longer than expected idling TCP connections, and potential performance issues.

Workaround:
Disabling the PVA resolves the issue.

---

597023-4 : NTP vulnerability CVE-2016-4954

Solution Article: K82644737

---

597010-4 : NTP vulnerability CVE-2016-4955

Solution Article: K03331206

---

596997-4 : NTP vulnerability CVE-2016-4956

Solution Article: K64505405

---

596945-2 : AVR DNS record lost after upgrade.

Component: Application Visibility and Reporting

Symptoms:
After upgrading to 11.5.1 through 11.6.0, you are unable to view DNS stats in AVR.

Conditions:
AVR enabled, DNS statistics visible in a version prior to 11.5.1, then upgrade to versions 11.5.1 through 11.6.0.

Impact:
You will be unable to view the DNS statistics.

Fix:
Fixed an issue with DNS stats not displaying in AVR after upgrade.

---

596814-3 : HA Failover fails in certain valid AWS configurations

Component: TMOS

Symptoms:
Some of the floating object's IPs might not be reattached to the instance acting as the new active device.

Conditions:
AWS deployments where there are multiple coincidences for the provided IP address (corresponding to other Amazon VPCs in the same Availability Zone containing unrelated instances but having the same IP address as the BIG-IP's floating IP address.

Impact:
Potential traffic disruption. Some of the floating object's IPs might not be reattached to the instance acting as the new active device.

Workaround:
Do not have AWS deployments with multiple VPCs sharing the same IP address as the BIG-IP's floating IP address.

Fix:
Failover now narrows network description by filtering with VPC id.

---

596619 : Some 10.2.x client SSL configurations fail to upgrade to 11.6.1.★

Solution Article: K00539510

Component: Local Traffic Manager

Symptoms:
Some 10.2.x client SSL configurations fail to upgrade to 11.6.1. The upgrade fails with an error similar to the following:

emerg load_config_files: "/usr/libexec/bigpipe load" - failed. -- BIGpipe parsing error (/config/bigpipe/BIG-IP.conf Line 67): 012e0020:3: The requested item (myclientssl {) is invalid (<profile arg> ` show ` list ` edit ` delete ` stats reset) for 'profile'.

Conditions:
Running 10.2.x with a Client SSL profile that has a custom Certificate and Key, and attempting to upgrade to version 11.6.1 or higher.

Impact:
The system fails to upgrade and presents a bigpipe parsing error.

Workaround:
If you have already upgraded and are encountering this issue, do the following:
1. Make a backup copy of /config/bigpipe/BIG-IP.conf.
2. Edit /config/bigpipe/BIG-IP.conf and remove any reference to inherit-certificatechain in the affected ssl profiles.
3. Run /usr/libexec/bigpipe daol.
4. Run tmsh save sys config.
5. Run tmsh load sys config.

This should install the configuration after upgrade failure.

Fix:
A 10.2.x configuration containing a Client SSL profile with a custom Certificate and Key now successfully upgrades to 11.6.1.

---

596603-11 : AWS: BIG-IP VE doesn't work with c4.8xlarge instance type.

Component: TMOS

Symptoms:
When deploying BIG-IP VE in AWS with c4.8xlarge instance type, the system never boots and remains in "Stopped" state after briefly trying to start-up.

Conditions:
BIG-IP VE is deployed with c4.8xlarge instance type in AWS.

Impact:
c4.8xlarge instance type are not supported for BIG-IP VE in AWS.

Workaround:
Choose c4.4xlarge or other instance types in AWS.

Fix:
Issue corrected so that BIG-IP VE will work with c4.8xlarge instance type AWS.

---

596569-2 : Memory leak on Central device in Symmetric deployment

Component: WebAccelerator

Symptoms:
When AAM is provisioned and symmetric configuration is deployed, a central unit will suffer a memory leak.

Conditions:
AAM is provisioned and a symmetric deployment is used.

Impact:
Due to memory leak BIG-IP will run out of memory and won't be able to properly serve new requests.

Fix:
It immediately releases a memory allocation which previously leaked once the allocation is no longer required.

---

596488-4 : GraphicsMagick vulnerability CVE-2016-5118.

Solution Article: K82747025

---

596340-3 : F5 TLS vulnerability CVE-2016-9244

Solution Article: K05121675

---

596116-2 : LDAP Query does not resolve group membership, when required attribute(s) specified

Component: Access Policy Manager

Symptoms:
Corresponding session variable session.ldap.last.memberOf contains only the groups user has explicit membership.

Conditions:
This occurs when the following conditions are met:
-- When APM LDAP Query is configured with option "Fetch groups to which the user or group belong" is set to "All".
-- The Required Attribute includes the "memberOf" LDAP attribute.

Impact:
Only groups the user is a direct member of will be populated to the APM 'session.ldap.last.memberOf' variable.

Workaround:
Add the following attribute to the "Required Attributes" list:

"objectClass"

If APM is communicating via LDAP with Microsoft Active Directory, consider adding this attribute to the list:

"primaryGroupID"

Note: Adding the "primaryGroupID" attribute will cause APM to fetch all groups Microsoft Active Directory, including the primary group.

Fix:
LDAP Query now retrieves groups from the backend server in accordance with option "fetch groups to which the user or group belong". it doesn't matter if any required attribute set or not set.

---

595874-4 : Upgrading 11.5.x/11.6.x hourly billing instances to 12.1.0 fails due to license SCD.★

Component: TMOS

Symptoms:
BIG-IP Virtual Edition (VE) instances that use the Amazon Web Services (AWS) hourly billing license model may fail when upgrading to version 12.1.0.

As a result of this issue, you may encounter the following symptom:

After upgrading to version 12.1.0, the BIG-IP VE instance license is invalid.

Conditions:
This issue occurs when all of the following conditions are met:

-- You have BIG-IP VE instances that use the hourly billing licensing model.
-- Your BIG-IP VE instances are running 11.5.x or 11.6.x software versions.
-- Your BIG-IP VE instances are running within the AWS EC2 environment.
-- You upgrade the BIG-IP VE instance using the liveinstall method.

Impact:
BIG-IP VE instance licenses are not valid after upgrading to software version 12.1.0.

Workaround:
To work around this issue, you can use the liveinstall method on the hotfix image directly (instead of installing the base software image and then the hotfix image). To do so, perform the following procedure:

Impact of workaround: Performing the following procedure requires rebooting the system and should be performed only during a maintenance window.

Download the BIGIP-12.1.0.0.0.1434.iso and Hotfix-BIGIP-12.1.0.1.1.1447-HF1-ENG.iso files to your workstation. For more information about downloading software, refer to SOL167: Downloading software and firmware from F5.
Copy the downloaded files from your workstation to the /shared/images directory on the VE instance.
To perform the installation by using the liveinstall method, and reboot the BIG-IP VE instance to the volume running the new software, use the following command syntax:

tmsh install sys software hotfix Hotfix-BIGIP-12.1.0.1.1.1447-HF1-ENG.iso volume <volume-number> reboot

For example, to install the hotfix to volume HD1.3 and reboot to the volume running the newly installed software, type the following command:

tmsh install sys software hotfix Hotfix-BIGIP-12.1.0.1.1.1447-HF1-ENG.iso volume HD1.3 reboot
 
Verify the installation progress by typing the following command:
tmsh show sys software

Output appears similar to the following example:

Sys::Software Status
Volume Product Version Build Active Status
----------------------------------------------------------------
HD1.1 BIG-IP 12.0.0 0.0.606 yes complete
HD1.2 BIG-IP 12.1.0 0.0.1434 no complete
HD1.3 BIG-IP 12.1.0 0.0.1434 no installing 6.000 pct

Fix:
BIG-IP VE instances that use the AWS hourly billing license model now complete successfully when upgrading to version 12.1.0.

---

595773-3 : Cancellation requests for chunked stats queries do not propagate to secondary blades

Component: TMOS

Symptoms:
Canceling a request for a chunked stats query (e.g. hitting ctrl-c during "tmsh show sys connection") does not stop data flowing from secondary blades.

Conditions:
A chassis-based system with multiple blades. Users must execute a chunked stats query (e.g. "tmsh show sys connection") and then cancel it before it finishes (e.g. with ctrl-c in tmsh).

Impact:
Unnecessary data will be sent from TMM to secondary mcpd instances, as well as from secondary mcpd instances to the primary mcpd instance. This could cause mcpd to restart unexpectedly.

Fix:
Cancellations for chunked stats queries are now propagated to secondary blades.

---

595275-2 : Virtual IP address change might cause VIP state to go from GREEN to RED to GREEN

Component: Local Traffic Manager

Symptoms:
Virtual IP address change might cause VIP state to go from GREEN to RED to GREEN when pool goes empty.

Conditions:
This occurs when the configuration contains a pool with only one FQDN pool member.

Impact:
VIP can go briefly RED and offline.

Workaround:
Configuring a fallback static IP node or multiple FQDN pool members removes this risk.

---

595270 : Memory leaks when session DB tables gets updated

Component: Traffic Classification Engine

Symptoms:
Memory usage stats indicate possible memory leaks.

Conditions:
When CEC flow bundling is used.

Impact:
Potential memory leaks.

Workaround:
Disable CEC flow bundling (tmm.gpa.cec.flow_bundling.enable = false).

---

594642-1 : Stream filter may require large allocations by Tcl leading TMM to core on allocation failure.

Component: Local Traffic Manager

Symptoms:
Stream filter may require large allocations by Tcl leading TMM to core on allocation failure.

Conditions:
Stream filter is active during low memory situations

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
Stream may now be configured to parse xbufs in chunks. This limits the maximum amount of memory required and reduces the chance of an allocation failure.

---

594496-3 : PHP Vulnerability CVE-2016-4539

Solution Article: K35240323

---

593667 : Dashboard displays incomplete alert details when Polish characters are included

Component: Fraud Protection Services

Symptoms:
Polish alerts are not fully displayed fully in the dashboard.

Conditions:
Alert details contain Polish characters.

Impact:
Causes difficulty assigning alert severity.

Workaround:
None

Fix:
Alerts are now displayed correctly.

---

593530-1 : In rare cases, connections may fail to expire

Component: Local Traffic Manager

Symptoms:
Connections have an idle timeout of 4294967295 seconds.

Conditions:
Any IP (ipother) profile is assigned to virtual server.

Impact:
Connections may linger.

Workaround:
None.

Fix:
Fixed idle initialization error when using Any IP (ipother) profile.

---

593447-2 : BIG-IP TMM iRules vulnerability CVE-2016-5024

Solution Article: K92859602

---

593070-5 : TMM may crash with multiple IP addresses per session

Component: Policy Enforcement Manager

Symptoms:
TMM crash

Conditions:
A session with multiple IP addresses with PCRF communication for dynamic policy management may have a crash credits to a race condition.

Impact:
Traffic disrupted while tmm restarts.

Fix:
Check for timer expiration prior to processing the timer.

---

592871-2 : Cavium Nitrox PX/III stuck queue diagnostics missing.

Component: Local Traffic Manager

Symptoms:
Diagnostics tool to investigate rare issue where the Cavium Nitrox PX/III crypto chip gets into a "request queue stuck" situation.

Conditions:
System with Cavium Nitrox PX/III chip(s) which includes the BIG-IP 5xxx, 7xxx, 10xxx, and 12xxx platforms as well as the VIPRIOn B2200 blade, that hits a rare issue which logs a "request queue stuck" message in /var/log/ltm.

Impact:
This tool enables F5 engineers to obtain more data about this problem to help diagnose the issue.

Workaround:
None.

Fix:
Provides a diagnostics tool. Does not directly mitigate the problem.

---

592870-3 : Fast successive MTU changes to IPsec tunnel interface crashes TMM

Component: TMOS

Symptoms:
Changing IPsec tunnel interface MTU attribute repeatedly in quick succession, TMM cores. This can occur whether or not traffic has flowed through the tunnel.

Conditions:
This occurs when quickly changing the IPsec tunnel interface MTU.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Change IPsec tunnel interface attributes at a rate of speed that allows each configuration modification to complete.

Fix:
TMM no longer cores if users quickly and repeatedly change interface attributes (for example, the MTU interface attribute).

---

592868-4 : Rewrite may crash processing HTML tag with HTML entity in attribute value

Component: Access Policy Manager

Symptoms:
If HTML page contains HTML entities in attribute values, rewrite may crash processing this page.

Conditions:
HTML tag like this:
<script src="&#10;" type="text/javascript"></script>

Impact:
Web application may not work correctly.

Workaround:
In most cases HTML entities can be replaced by appropriate characters by iRule.

Fix:
Now rewrite correctly handles HTML entities in attribute values.

---

592854-4 : Protocol version set incorrectly on serverssl renegotiation

Component: Local Traffic Manager

Symptoms:
If the BIG-IP serverssl profile sends a new ClientHello request to renegotiate SSL, the protocol version will be set to 0. This will cause renegotiation to fail.

Conditions:
ServerSSL profile configured on a virtual server, and BIG-IP initiates a renegotiation.

Impact:
Protocol field is invalid (0), and the server will reset the connection.

Fix:
Fixed a reset issue with SSL renegotiation in the serverssl profile.

---

592784-4 : Compression stalls, does not recover, and compression facilities cease.

Component: Local Traffic Manager

Symptoms:
Compression stalls, does not recover, and compression facilities may cease.

Conditions:
A device error of any kind, or requests that result in the device reporting an error (for example, attempting to decompress an invalid compression stream).

Impact:
In general, compression stops altogether. Under some circumstances, compression requests may end up routed to zlib (software compression), but generally the SSL hardware accelerator card does not correctly report that it is unavailable when it stalls.

Workaround:
Select the softwareonly compression provider by running the following tmsh command: tmsh modify sys db compression.strategy value softwareonly.

Fix:
The compression device driver now attempts to recover after a failure. If it still cannot recover, new compression requests will be assigned to zlib (software) for compression.

---

592591-1 : Deleting access profile prompts for apply access policy for other untouched access profiles

Component: Access Policy Manager

Symptoms:
After deleting an access profile, the 'Apply Access Policy' link shows up and the status flags for some other untouched access profiles turn yellow. Also, there are APM log messages indicating that the configurations for those untouched access profile have been changed.

Conditions:
If an access profile containing macros is copied on the admin UI and is deleted subsequently.

Impact:
There is no change to the access profiles that are affected by the deletion. Admin can go ahead to click "Apply Access Policy" link to make the link disappear.

---

592497-2 : Idle timeout ineffective for FIN_WAIT_2 when server-side expired and HTTP in fallback state.

Component: Local Traffic Manager

Symptoms:
While passing normal traffic, CPU utilization of one or more tmms suddenly goes to 100% as viewed by top and remains there indefinitely.

Conditions:
Idle timeout for tcp flows in FIN_WAIT_2.

Impact:
There is a rare occurrence in which tmm might result in 100% CPU busy.

Workaround:
None.

Fix:
This release honors the idle timeout in FIN_WAIT_2 when server-side expired and HTTP in fallback state.

---

592485-2 : Linux kernel vulnerability CVE-2015-5157

Solution Article: K17326

---

592414-2 : IE11 and Chrome throw "Access denied" during access to any generic window property after document.write() into its parent has been performed

Component: Access Policy Manager

Symptoms:
IE11 and Chrome throw "Access denied" during access to any generic window property after document.write() into its parent has been performed from dynamically generated child.

Conditions:
Browsers: IE11 and Chrome
When: After document.write() into its parent has been performed from dynamically generated child.

Impact:
Web application malfunction.

Workaround:
None.

Fix:
Fixed.

---

592113-1 : tmm core on the standby unit with dos vectors configured

Component: Advanced Firewall Manager

Symptoms:
On the standby unit with mirrored connections configured, uninitialized dos_vectors may cause core dump

Conditions:
HA setup, mirroring enabled on a virtual that has dos vectors configured

Impact:
Traffic disrupted while tmm restarts.

---

592070-1 : DHCP server connFlow when created based on the DHCP client connFlow does not have the traffic group ID copied

Component: Policy Enforcement Manager

Symptoms:
Variables in the flow context when stored in the sessionDB cannot be shared since the traffic groups of the server and client flows are different.

Conditions:
DHCP virtual created in a non-local traffic group.

Impact:
Variable sharing in the TCL context will not work.

Workaround:
Modify SysDb variable "Tmm.SessionDB.match_ha_unit" to disable the use of traffic-group ID while accessing the sessionDB.

Fix:
Copy the traffic group from client to server connFlows such that both connFlows have the same traffic group.

---

592001-2 : CVE-2016-4073 PHP vulnerabilities

Solution Article: K64412100

---

591918-4 : ImageMagick vulnerability CVE-2016-3718

Solution Article: K61974123

---

591908-4 : ImageMagick vulnerability CVE-2016-3717

Solution Article: K29154575

---

591894-4 : ImageMagick vulnerability CVE-2016-3715

Solution Article: K10550253

---

591881-4 : ImageMagick vulnerability CVE-2016-3716

Solution Article: K25102203

---

591857 : 10-core vCMP guest with ASM may not pass traffic

Component: TMOS

Symptoms:
The TMM plugin manager does not expect/support an ASM guest configuration of 10 cores, thus its calculations as to the number of devices required and numbering does not match the existing number of threads/devices.

Conditions:
11.6.0 HF6
ASM provisioned on a vCMP guest
10 CPU cores allocated to an ASM guest

Impact:
System may not start or may exhibit intermittent failures.

Workaround:
Change the number of cores on the ASM guest to use either 8 CPU cores or 12 CPU cores.

Fix:
This issue was partially fixed in 11.6.0 HF6, but the tmplugin RPM was incorrect. This fix includes the proper RPM.

---

591806-3 : ImageMagick vulnerability CVE-2016-3714

Solution Article: K03151140

---

591789-1 : IPv4 fragments are dropped when packet filtering is enabled.

Component: Local Traffic Manager

Symptoms:
IPv4 fragments are dropped when packet filtering is enabled.

Conditions:
Packet filtering is enabled on version 11.5.4, 11.6.0 HF6, or 11.6.1.

Impact:
IPv4 fragments with a non-zero offset are lost.

Workaround:
Disable packet filtering.

Fix:
IPv4 fragments are no longer incorrectly dropped when packet filtering is enabled.

---

591767-3 : NTP vulnerability CVE-2016-1547

Solution Article: K11251130

---

591733-2 : Save on Auto-Sync is missing from the configuration utility.

Solution Article: K83175883

Component: TMOS

Symptoms:
The option to configure save-on-auto-sync is missing in the Device Management GUI.

Conditions:
Devices configured in a DSC configuration.
Automatic with Full or Incremental Sync is enabled.
You attempt to configure the save-on-auto-sync option from the GUI.

Impact:
You will need to have TMSH access to the BIG-IP system to perform this task.

Workaround:
You will need to have TMSH access to the BIG-IP system to perform this task.

Fix:
This release adds per-device-group save_on_auto_sync flag to GUI: flag now shows in GUI and correctly saves.
GUI: The "Sync Type" option in the GUI must be set to "Automatic with Full/Incremental Sync" in order for "Save on Auto-Sync" option to show.

Behavior Change:
Beginning in version 11.5.0, the /cm trust-domain 'save-on-auto-sync' attribute is no longer configured as part of the trust-domain, but is part of the configuration of a device group. With this change, the option to set that attribute becomes available in the GUI on the condition that the "Sync Type" option is set to "Automatic with Full/Incremental Sync".

---

591659-3 : Server shutdown is propagated to client after X-Cnection: close transformation.

Solution Article: K47203554

Component: Local Traffic Manager

Symptoms:
Server shutdown is propagated to client after X-Cnection: close transformation.

Conditions:
In OneConnect configurations, when a server's maximum number of keep-alives is exceeded, the server closes the connection between itself and the BIG-IP system. This Connection: Close is transformed to an X-Cnection: close and sent to the Client along with a TCP FIN.

Impact:
Client side connections are closed by the BIG-IP system too early, causing subsequent requests to be dropped.

Workaround:
Set the OneConnect profile "Maximum Reuse" value to 2 below the value of the pool members max keep-alive setting. This forces OneConnect to close the connection before the pool member.

Fix:
Server shutdown is no longer propagated to client after X-Cnection: close transformation, so client side connections are now kept open by the BIG-IP system as expected, and subsequent requests are no longer dropped.

---

591476-8 : Stuck crypto queue can erroneously be reported

Solution Article: K53220379

Component: Local Traffic Manager

Symptoms:
In some cases, a stuck crypto queue can be erroneously detected on Nitrox-based systems (Nitrox PX and Nitrox 3). When the tmm/crypto stats are examined, they show no queued requests. The following message appears in the ltm log: Device error: crypto codec cn-crypto-0 queue is stuck.

Conditions:
-- Running on one of the following platforms:
 + BIG-IP 800, 1600, 3600, 3900, 6900, 89xx, 5xxx, 7xxx, 10xxx, 11xxx, and 12xxx
 + VIPRION B41xx-B43xx, B21xx, and B22xx blades.
-- Performing SSL.
-- Under heavy load.

Impact:
Device errors reported in logs and crypto HA action is taken, possibly resulting in failing over.

Workaround:
Modify the crypto queue timeout value to 0 to prevent timeouts using the following command:

tmsh modify sys db crypto.queue.timeout value 0

Fix:
The crypto driver now only examines requests in the hardware DMA ring to detect a stuck queue.

---

591455-2 : NTP vulnerability CVE-2016-2516

Solution Article: K24613253

---

591447-3 : PHP vulnerability CVE-2016-4070

Solution Article: K42065024

---

591438-2 : PHP vulnerability CVE-2015-8865

Solution Article: K54924436

---

591343-2 : SSL::sessionid output is not consistent with the sessionid field of ServerHello message.

Component: Local Traffic Manager

Symptoms:
SSL::sessionid output is not consistent with the sessionid field of ServerHello message. This is mostly cosmetic, but if an iRule depends upon the outcome, the result can be unexpected.

Conditions:
This occurs when using an iRule to inspect the session ID on server-side SSL.

Impact:
The values do not match. SSL::sessionid outputs the wrong sessionid.

Workaround:
None.

Fix:
The returned session ID in both the SERVERSSL_SERVERHELLO and SERVERSSL_HANDSHAKE events is the one presented by the SSL server.

---

591329-2 : CVE-2016-2108 fixed in Oracle Access Manager library used by BIG-IP APM

Solution Article: K36488941

---

591328-2 : OpenSSL vulnerability CVE-2016-2106

Solution Article: K36488941

---

591327-2 : OpenSSL vulnerability CVE-2016-2106

Solution Article: K36488941

---

591325-2 : OpenSSL (May 2016) CVE-2016-2108,CVE-2016-2107,CVE-2016-2105,CVE-2016-2106,CVE-2016-2109

Solution Article: K75152412

---

591268-3 : VS hostname is not resolvable when DNS Relay proxy is installed and running under certain conditions

Component: Access Policy Manager

Symptoms:
VS hostname is not resolvable when DNS Relay proxy is installed and running under certain conditions, it depends on client machine configuration. Symptom: negative record in windows DNS cache, can be verified by running ipconfig /displaydns

Conditions:
Specific client machine configuration

Impact:
VS hostname is not resolvable:
- 'Refresh' of webtop causes unavailable webtop
- Recurring check report may fail due to DNS resolve issue

Workaround:
* Clean windows DNS cache: ipconfig /flushdns
or
* Disable DNS Relay proxy service

Fix:
Now DNS Relay proxy service cleans up DNS cache after initialization mitigating issue described

---

591117-1 : APM ACL construction may cause TMM to core if TMM is out of memory

Component: Access Policy Manager

Symptoms:
During ACL construction, TMM send queries regarding assigned ACL information. If the reply message contains error message of out-of-memory, TMM was not handling this error message properly, and cause TMM to core.

Conditions:
BIG-IP is extremely loaded and out of memory.

Impact:
Traffic disrupted while tmm restarts.

Fix:
When handling the error reply message of out-of-memory during ACL construction, TMM can handle it without causing TMM to crash.

---

591104-3 : ospfd cores due to an incorrect debug statement.

Component: TMOS

Symptoms:
ospfd cores due to an incorrect debug statement.

Conditions:
This occurs in NSSA configs when ASE OSPF debugging enabled in imish (for example, by running the command: debug ospf route ase). Affected configuration commands are (in imish):
debug ospf all.
debug ospf route.
debug ospf route ase.

Impact:
ospfd might crash, interrupting dynamic routing.

Workaround:
Do not enable debugging in ospf that includes 'route ase'.

Fix:
ospfd no longer crashes when debugging is enabled in imish.

---

591042-5 : OpenSSL vulnerabilities

Solution Article: K23230229

---

590904-5 : New HA Pair created using serial cable failover only will remain Active/Active

Component: TMOS

Symptoms:
After creating a new sync-failover device group without network failover enabled, both devices remain Active.

Conditions:
Create a new sync-failover device-group without enabling network failover.

Impact:
Both device in the HA pair will be Active, which is unlikely to pass traffic successfully.

Workaround:
After adding the 2nd device to the sync-failover group, restart sod with "bigstart restart sod" on both devices.

Fix:
After creating the sync-failover group with without network failover configured, but a serial failover cable installed, one of the devices becomes Standby and the other remains Active.

---

590820-2 : Applications that use appendChild() or similar JavaScript functions to build UI might experience slow performance in Microsoft Internet Explorer browser.

Component: Access Policy Manager

Symptoms:
Applications that use appendChild() or similar JavaScript functions to build UI might experience slow performance in Microsoft Internet Explorer browser.

Conditions:
Intense usage of JavaScript methods such as: appendChild(), insertBefore(), and other, similar JavaScript methods, in a customer's web application code.

Impact:
Very low web application performance when using Microsoft Internet Explorer.

Workaround:
None.

Fix:
Applications that use appendChild() or similar JavaScript functions to build UI now experience expected performance in Microsoft Internet Explorer browser.

---

589794 : APD might crash if LDAP Query agent failed to retrieve primary group for a user

Component: Access Policy Manager

Symptoms:
APD will crash and generate a core file.

Conditions:
The problem can happen only when the following is true:
1. LDAP Query is used with AD backend
2. "Fetch groups to which the user or group belong" is defined other value than None (direct/all)
3. There were logins to bigip before, so group cache is built and valid
4. New group created in the domain and assigned as a primary group for the user trying to authenticate

Impact:
Authentication service will be interrupted.

Workaround:
Administrator should reset group cache using either GUI (AAA LDAP Server configuration page) or tmsh (apm aaa ldap object). After cache is reset, it will be built from scratch on next request and the new group will be added to the cache.

---

589256-3 : DNSSEC NSEC3 records with different type bitmap for same name.

Component: Global Traffic Manager

Symptoms:
For a delegation from a secure zone to an insecure zone, BIG-IP returns different type bitmaps in the NSEC3 record depending on the query type. This causes BIND9's validator to reject the secure delegation to the insecure zone.

Conditions:
For insecure delegations, our DNSSEC implementation does not support the DS record. Those queries are forwarded to the backend, BIND if selected as fallback. Without ZSK/KSK for an insecure child zone, BIND responds SOA which we dynamically sign.

Impact:
DNS lookups may fail if BIND9's validator rejects the delegation.

Workaround:
None.

Fix:
If response is a NODATA from either the proxy or a transparent cache, and the query is a DS, set the types bitmap to NS.

---

589223-3 : TMM crash and core dump when processing SSL protocol alert.

Component: Local Traffic Manager

Symptoms:
TMM crash and core dump when processing SSL protocol alert.

Conditions:
During SSL handshake, if the server sends protocol Alert to the BIG-IP system, TMM might crash.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
A problem of TMM restarting when processing SSL protocol alert has been fixed.

---

589118 : Horizon View client throws an exception when connecting to Horizon 7 VCS through APM.

Solution Article: K81314569

Component: Access Policy Manager

Symptoms:
If APM is configured as PCoIP proxy against Horizon 7 VCS, the Horizon View client fails to retrieve the list of entitlements with an exception written in its logs.

Conditions:
APM as PCoIP proxy for Horizon 7 View Connection Server.

Impact:
Horizon View client cannot be used with APM to access Horizon 7.

Workaround:
You can use the following iRule to update the broker protocol version returned by APM to be 11.0 instead of 9.0.

when HTTP_REQUEST {
   if { [HTTP::header "Origin"] ne "" } {
        HTTP::header remove "Origin"
    }
     if { [ HTTP::method ] == "POST" && [ HTTP::uri ] == "/broker/xml" } {
        set BROKER_REQUEST 1
        HTTP::collect [HTTP::header Content-Length]
    }
}

when HTTP_REQUEST_DATA {
    if { [ info exists BROKER_REQUEST ] && [ regexp {<have-authentication-types[ \t\r\n]*>[ \t\r\n]*<name[ \t\r\n]*>[ \t\r\n]*saml[ \t\r\n]*</name>[ \t\r\n]*</have-authentication-types>} [HTTP::payload] ] } {
        HTTP::respond 200 content {<?xml version="1.0" encoding="UTF-8"?><broker version="11.0"><set-locale><result>ok</result></set-locale><configuration><result>ok</result><broker-guid>1</broker-guid><authentication><screen><name>saml</name><params></params></screen></authentication></configuration></broker>} Content-Type text/xml
    }
}

when HTTP_RESPONSE {
    if { ! [ IP::addr [ IP::remote_addr ] equals 127.0.0.0/8 ] } { return }
    set BROKER_RESPONSE 1
    set content_length 0
    if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
        set content_length [HTTP::header "Content-Length"]
    } else {
        set content_length 1048576
    }
    # Check if $content_length is not set to 0
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
}

when HTTP_RESPONSE_DATA {
    if { ! [ info exists BROKER_REQUEST ] || ! [ info exists BROKER_RESPONSE ] } { return }
    regsub "<broker version=\"9.0\">" [HTTP::payload] "<broker version=\"11.0\">" payload
    HTTP::payload replace 0 [HTTP::payload length] $payload
    HTTP::release
}

Fix:
Horizon View client can now be used with APM to access Horizon 7.

---

588888-2 : Empty URI rewriting is not done as required by browser.

Solution Article: K80124134

Component: Access Policy Manager

Symptoms:
Empty URI must be rewritten at server side and client side rewriter in the same way: as empty URI (all browsers treat this type of URI in a specific way).

Conditions:
A tag with an empty 'src' or 'href' attribute.

Impact:
Web application malfunction, such as incorrect or unexpected behavior or error messages.

Workaround:
Use an application-specific iRule that modifies the empty URI.
-- For example, for JavaScript methods such as setAttribute(), an iRule should change this:
'F5_Invoke_setAttribute(o, "src", uri)'
to this:
'(uri=="")?o.setAttribute("src", uri):F5_Invoke_setAttribute(o, "src", uri)'.

-- As another example, for JavaScript methods such as write(str), writeln(str), innerHTML=str, outerHTML=str, and similar methods, if str contains <img src="" ... >, the iRule must remove the src attribute.

Fix:
This release fixes the issue of rewriting the empty URI the same way at the server side and client side: as empty URI (all browsers treat this type of URI in a specific way).

---

588496-3 : SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541

Solution Article: K10737

---

588442-3 : TMM can core in a specific set of conditions.

Component: Local Traffic Manager

Symptoms:
TMM can core and assert: 'ifc not set'.

Conditions:
This occurs under the following conditions:
  - A unit with license that ratelimits throughput performance to something other than max or 1.
  - One or more virtual IP addresses configured with DNS profiles with rapid-response enabled.
  - Something causing the listener to be disabled or a listener to not be found.
  - A DNS request sent to the disabled listener.

Impact:
TMM might core and assert: 'ifc not set'.

Workaround:
None.

---

588351-2 : IPv6 fragments are dropped when packet filtering is enabled.

Component: Local Traffic Manager

Symptoms:
IPv6 fragments are dropped when packet filtering is enabled.

Conditions:
Packet filtering is enabled and the system is processing IPv6 fragments.

Impact:
IPv6 fragments with a non-zero offset are lost.

Workaround:
Disable packet filtering.

Fix:
IPv6 fragments are no longer dropped when packet filtering is enabled.

---

588289-4 : GTM is Re-ordering pools when adding pool including order designation

Component: Global Traffic Manager

Symptoms:
GTM re-orders, including the "0" order when adding the pool with specific order designation.

Conditions:
This occurs when adding pools with a specified order.

Impact:
This changes the pool order unexpectedly which will affect Load balancing using global-availability.

---

588115-3 : TMM may crash with traffic to floating self-ip in range overlapping route via unreachable gw

Component: Local Traffic Manager

Symptoms:
As a result of a known issue TMM may crash in some specific scenarios if there is an overlapping and more specific route to the floating self-IP range configured on the unit.

Conditions:
- Unit configured with a floating self-IP and allow-service != none.
  - More specific route exists via GW to the self-IP.
  - Configured gateway for the overlapping route is unreachable.
  - Ingress traffic to the floating self-IP.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid the use of routes overlapping with configured floating self-IPs.

Fix:
TMM no longer crashes when floating self IPs are configured with more specific overlapping routes.

---

587966-3 : LTM FastL4 DNS virtual server: first A query dropped when A and AAAA requested at the same time with same source IP:port

Solution Article: K77283304

Component: Local Traffic Manager

Symptoms:
LTM FastL4 DNS virtual server or SNAT: first A query dropped when A and AAAA requested at the same time with same source IP:port.

Conditions:
A and AAAA DNS Query requested at the same time with the same source IP and Port.

Impact:
A Type DNS Query dropped intermittently.

Workaround:
Configure a standard virtual server with a UDP profile for the traffic instead of using FastL4 or SNAT.

Fix:
Type A requests no longer dropped when A and AAAA DNS Query requested at the same time with the same source IP and Port.

---

587892-1 : Multiple iRule proc names might clash, causing the wrong rule to be executed.

Component: Local Traffic Manager

Symptoms:
Multiple iRule proc names might clash, causing the wrong rule to be executed.

Conditions:
This occurs when there is an iRule configured with more than one proc, which might cause the wrong proc to get executed.

Impact:
The call proc might execute the wrong proc.

Workaround:
None.

Fix:
Multiple iRules configured with more than one proc no longer cause the wrong proc to get executed.

---

587698-2 : bgpd crashes when ip extcommunity-list standard with route target(rt) and Site-of-origin (soo) parameters are configured

Component: TMOS

Symptoms:
bgpd daemon crashes

Conditions:
bgp extended-asm-cap is configured before configuring
ip extcommunity-list standard with rt and soo fields.

Impact:
bgpd daemon crashes leading to route loss and traffic loss.

Fix:
bgpd does not crash when both bgp extended-asm-cap and
ip extcommunity-list standard with rt and soo parameters are configured.

---

587656-3 : GTM auto discovery problem with EHF for ID574052

Component: Global Traffic Manager

Symptoms:
After applying EHF9-685.88-ENG to CRCGTMCS101, many WideIPs such as CRT-LEGAL-SERVICE.gslb.global or OneEvent.gslb.global are unexpectedly status Checking instead of Available.

Conditions:
After applying EHF9-685.88-ENG

Impact:
Many WideIPs such as CRT-LEGAL-SERVICE.gslb.global or OneEvent.gslb.global are unexpectedly status Checking instead of Available.

Workaround:
Skip to the next Eng HF
v11.4.1-hf10/hotfix/HF10-690.10-ENG

Fix:
This problem only occurs with the one faulty EHF9-685.88-ENG and does not occur anywhere else.

---

587617-3 : While adding GTM server, failure to configure new IP on existing server leads to gtmd core

Component: Global Traffic Manager

Symptoms:
gtmd core with SIGSEGV in selfip_needs_xlation.

Conditions:
No GTM server object configured with existent selfip.

Impact:
gtmd cores. GTM unable to respond to DNS queries. DNS traffic disrupted while gtmd restarts.

Workaround:
Configure the GTM server object with an existent selfip. For more information, see K15671: The BIG-IP GTM system must use a local self IP address to define a server to represent the BIG-IP GTM system at https://support.f5.com/csp/#/article/K15671

Fix:
gtmd will not core.

---

587077-3 : Samba vulnerabilities CVE-2015-5370 and CVE-2016-2118

Solution Article: K37603172

---

586878-2 : During upgrade, configuration fails to load due to clientssl profile with empty cert/key configuration.★

Component: TMOS

Symptoms:
During upgrade, configuration fails to load due to invalid clientssl profile cert/key configuration. The validation to verify whether at least one valid key/cert pair exists in clientssl profiles was enforced in software versions through 11.5.0. This validation was not in effect in versions 11.5.1, 11.5.2, and 11.5.3.

The lack of validation resulted in invalid clientssl profiles (those containing empty key/certs or a cert/key of 'default'). When you upgrade such a configuration to 11.5.4 or later, you will receive a validation error, and the configuration will fail to load after upgrade.

Conditions:
The issue occurs when all the below conditions are met.
1. You have a clientssl profile in a configuration from a version without validation (that is, 11.5.1, 11.5.2, or 11.5.3).
2. The clientssl profile in the configuration has an empty cert/key, or a cert/key of 'default'.
3. You upgrade to a version that has the cert/key validation (specifically, 11.5.4, 11.6.0, 11.6.1, and versions 12.1.0 and later).

Impact:
Configuration fails to load. The system posts an error message that might appear similar to one of the following:
-- 01070315:3: profile /Common/my_client_ssl requires a key Unexpected Error: Loading configuration process failed.
-- 01071ac9:3: Unable to load the certificate file () - error:2006D080:BIO routines:BIO_new_file:no such file.
Unexpected Error: Loading configuration process failed.

Workaround:
To workaround this situation, modify the configuration file before upgrading:
1. Check the config file /config/bigip.conf.
2. Identify the clientssl profile without a cert/key.
    For example, it might look similar to the following:
    ltm profile client-ssl /Common/cssl_no-cert-key2 {
        app-service none
        cert none
        cert-key-chain {
            "" { }
        }
        chain none
        defaults-from /Common/clientssl
        inherit-certkeychain false
        key none
        passphrase none
    }

   Note: The profile might have cert-key-chain name but not the cert/key. In other words, it could also appear similar to the following example:
    ltm profile client-ssl /Common/cssl_no-cert-key2 {
        app-service none
        cert none
        cert-key-chain {
            default { }
        }
        chain none
        defaults-from /Common/clientssl
        inherit-certkeychain false
        key none
        passphrase none
    }
3. Remove the clientssl profile from /config/bigip.conf.
4. Run the command: tmsh load sys conf.
5. Re-create the clientssl profiles you need.

---

586738-2 : The tmm might crash with a segfault.

Component: Local Traffic Manager

Symptoms:
The tmm might crash with a segfault.

Conditions:
Using IPsec with hardware encryption.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
IPsec is configured with hardware encryption error now returns an error code when appropriate, and manages the error as expected, so tmm no longer crashes with a segfault.

---

586718-3 : Session variable substitutions are logged

Component: Access Policy Manager

Symptoms:
With the log level set to debug, session variable substitutions are logged, including the encrypted password if you are substituting the password variable. You may see the following logs: debug apmd[3531]: 01490000:7: Util.cpp func: "ScanReplaceSessionVar()" line: 608 Msg: data: '%{session.logon.last.password}' start_pos: 0, count: 30 on 'session.logon.last.password' with the encrypted password logged

Conditions:
APM Access Policy log level set to debug, and session variable substitution is performed.

Impact:
Session variable substitution should not be logged, even if it is secure.

Workaround:
Set log level to informational or notice for normal operations. Logging at debug level is not recommended unless absolutely needed for specific troubleshooting as it adversely affects system performance.

Fix:
Session variable substitutions are no longer logged.

---

586131-3 : SSLv3 vulnerability CVE-2014-3566

Solution Article: K15702

---

586006-3 : Failed to retrieve CRLDP list from client certificate if DirName type is present

Component: Access Policy Manager

Symptoms:
Client certification revocation check will fail.

Conditions:
Two conditions will trigger this problem:
1. A CRLDP agent is configured in the access policy without server hostname and port, which is needed for DirName type processing. AND
2. At least one DirName type CRLDP is present in the client certification and it is the first in the list.

Impact:
Users may fail access policy evaluation when client certification is used.

Workaround:
Configure an LDAP server for the CRLDP object. It need not return a valid CRL.

---

585562-1 : VMware View HTML5 client shipped with Horizon 7 does not work through BIG-IP APM in Chrome/Safari

Component: Access Policy Manager

Symptoms:
When using Google Chrome or Safari (WebKit-based) browser to launch VMware View HTML5 client for Horizon 7 from APM webtop, this attempt fails with a blank screen in place of remote desktop session.

Conditions:
-- BIG-IP APM configured as PCoIP proxy for Horizon 7.
-- APM webtop in which the HTML5 client is used to launch a remote desktop.

Impact:
Cannot use HTML5 client. Only native client (Horizon View client) is available.

Workaround:
when HTTP_REQUEST {
    if { [HTTP::header "Origin"] ne "" } {
        HTTP::header remove "Origin"
    }
}

Fix:
VMware View HTML5 client shipped with Horizon 7 now work sthrough BIG-IP APM in Chrome/Safari.

---

585485-4 : inter-ability with "delete IPSEC-SA" between AZURE, ASA, and the BIG-IP system

Component: TMOS

Symptoms:
Some IKEv1 IPsec vendor implementations (for example Cisco ASA) send a delete SPI message for an IPsec-SA and expect that the sibling IPsec-SA (the SPI in the other direction) will also be deleted by the peer.

The BIG-IP system sends and expect messages with two SPI's inside.

Conditions:
An IPsec tunnel between a BIG-IP system and some other vendor may experience this. Azure and Cisco ASA are two such vendors.

Impact:
An IPsec tunnel goes down and in some situations may not renegotiate while the BIG-IP believes that the outgoing SPI is still active. The tunnel will stay down until the lifetime of the outbound SA expires.

Workaround:
Delete the outbound SA from the BIG-IP using the tmsh command by specifying the related SA:

(tmos)# delete net ipsec ipsec-sa ?
Properties:
  "{" Optional delimiter
  dst-addr Specifies the destination address of the security associations
  spi Specifies the SPI of the security associations
  src-addr Specifies the source address of the security associations
  traffic-selector Specifies the name of the traffic selector

Fix:
The BIG-IP system will remove both SAs associated with one traffic-selector (tunnel) when the peer sends a delete SPI message.

---

585424-3 : Mozilla NSS vulnerability CVE-2016-1979

Solution Article: K20145801

---

585412-2 : SMTPS virtual server with activation-mode allow will RST non-TLS connections with Email bodies with very long lines

Component: Local Traffic Manager

Symptoms:
Connections to a virtual server that uses an SMTPS profile may be reset with a reset cause of 'Out of memory.'

Conditions:
This might occur under the following conditions:
-- A virtual server that uses an SMTPS profile with activation-mode set to allow.
-- A client connection which does not use TLS that sends a DATA section with a text line that is longer than approximately 8192 characters.

8192 characters is an approximation for the maximum line length. The actual problem length can be affected by the MSS value and the particular way that the TCP traffic is segmented.

Impact:
The TCP connection is reset with a reset-cause of Out of memory' and the email will not be delivered.

Workaround:
None.

Fix:
A virtual server that uses an SMTPS profile with activation-mode set to allow no longer resets connections when the client does not use STARTTLS and the email body contains very long lines.

---

585097-3 : Traffic Group score formula does not result in unique values.

Component: TMOS

Symptoms:
In certain configurations, the Traffic Group score for a particular Traffic Group can be identical across devices in a device service cluster, resulting in the Traffic Group becoming Active on more than one device simultaneously.

Conditions:
The score is derived from the management-ip and other factors. If the device management-ips are not on the same /24 subnet, the score is not guaranteed to be unique.

The score can be observed with the tmsh "run cm watch_trafficgroup_device" command, and in some versions of BIG-IP, the "show cm traffic-group" command.

Impact:
When the problem occurs, Traffic Groups will be Active on multiple devices simultaneously. The problem can affect all Traffic Groups.

Workaround:
The only solution is to change the management-ip on one of the colliding devices. The workaround is not practical with DHCP, and in many other situations.

Fix:
The Active device selection logic has been changed to deterministically choose the Active device location, even in cases with identical static scores.

---

584373-3 : AD/LDAP resource group mapping table controls are not accessible sometimes

Component: Access Policy Manager

Symptoms:
AD/LDAP resource group mapping
In case of both lengthy group names and resource names edit link and control buttons could disapper under dialogue bounds

Conditions:
very long group names and resource names

Impact:
Impossible to delete and move rows in table - still possible to edit tho.

Workaround:
Spread one assign thru multiple rows

Fix:
Scroll bar is appearing when needed

---

584029-2 : Fragmented packets may cause tmm to core under heavy load

Component: Local Traffic Manager

Symptoms:
In rare circumstances, the Traffic Management Microkernel (TMM) process may produce a core file while processing fragmented packets.

As a result of this issue, you may encounter one or more of the following symptoms:

-- TMM generates a core file in the /shared/core directory.
-- In one of the /var/log/tmm log files, you observe an error message similar to the following example:
 notice panic: ../base/flow_fwd.c:255: Assertion "ffwd flag set" failed.
 panic: ../net/packet.c:168: Assertion "packet is locked by a driver" failed.

notice ** SIGFPE **

Conditions:
This issue occurs when all of the following conditions are met:

-- The TMM process offloads a fragmented packet by way of an ffwd operation.
-- Your BIG-IP system is under heavy load.

Impact:
The BIG-IP system temporarily fails to process traffic while the TMM process restarts. If the BIG-IP system is configured for high availability (HA), the system fails over to a peer system.

Workaround:
None.

Fix:
Fragmented packets no longer cause tmm to core under heavy load.

---

583957-4 : The TMM may hang handling pipelined HTTP requests with certain iRule commands.

Component: Local Traffic Manager

Symptoms:
Rarely, the TMM may hang during a HTTP::respond or HTTP::redirect iRule command if it is part of a pipelined HTTP request.

Conditions:
A HTTP::respond or HTTP::redirect iRule is used.
The iRule command is in an event triggered on the client-side.
A pipelined HTTP request is being handled.

Impact:
The TMM will be restarted by SOD.

Fix:
The TMM no longer hangs in rare situations when processing a pipelined HTTP request and invoking a HTTP::respond or HTTP::redirect iRule command.

---

583936-3 : Removing ECMP route from BGP does not clear route from NSM

Component: TMOS

Symptoms:
When configured to install multiple routes into the routing table, ZebOS does not withdraw BGP routes when a neighbor is shut down and it has more than two routes already installed for the same route prefix.

Conditions:
ECMP routing must be enabled and in-use.

Impact:
ECMP routes are not properly removed from the main routing table.

Fix:
Now properly removing ECMP routes from the routing table.

---

583686-3 : High ASCII meta-characters can be disallowed on UTF-8 policy via XML import

Component: Application Security Manager

Symptoms:
After importing an XML policy, you cannot view or edit policies containing high ASCII characters.

Conditions:
This occurs when importing XML policies containing high-ASCII meta-characters but high-ASCII is not allowed in a UTF-8 policy.

Impact:
Unable to view or edit the policy, and Illegal meta character in value violation is triggered

---

583516-3 : tmm ASSERT's "valid node" on Active, after timer fire..

Component: TMOS

Symptoms:
TMM crashes on ASSERT's "valid node".

Conditions:
The cause is unknown, and this happens rarely.

Impact:
tmm crash

Workaround:
no

Fix:
TMM no longer asserts on 'valid node'

---

583445 : Alert dashboard does not correctly display Hebrew characters in alerts.

Component: Fraud Protection Services

Symptoms:
Alert server cannot decrypt Hebrew characters in alerts.

Conditions:
Malicious script injection containing wide characters.

Impact:
Incorrectly displayed alerts in dashboard.

Workaround:
None.

Fix:
Alerts are sent encoded and are decoded in the dashboard.

---

583285-7 : BIG-IP logs INVALID-SPI messages but does not remove the associated SAs.

Component: TMOS

Symptoms:
The BIG-IP system logs INVALID-SPI messages but does not remove the associated Security Associations (SAs) corresponding to the message. This is the second part of a fix provided for this issue. See fixes for bug 569236 for the first part.

Conditions:
This can occur if an IPsec peer deletes a phase2 (IPsec) SA and does not send a 'notify delete' message to the other peer. The INVALID-SPI message is most likely to be seen when the peer deletes an SA before the SA's agreed lifetime.

Impact:
If the BIG-IP is always the Initiator, the Responder will not initiate a new tunnel if the Responder only handles responses to the BIG-IP clients' traffic. The BIG-IP system continues to use the IPsec SA it believes to be still up. When an SA expires prematurely, some IPsec peers will reject an inbound SPI packet with an ISAKMP INVALID-SPI notify message. If the INVALID-SPI message does not cause new SAs to be created, there will be a tunnel outage until the SA lifetime expires on the defunct SA held on the BIG-IP system.

Workaround:
Manually remove the invalid SA on the BIG-IP system.

Fix:
Now, when the BIG-IP system receives INVALID-SPI messages, it deletes the invalid Security Association as well as logging the INVALID-SPI message, so the tunnel can initiate again. This is part two of a two-part fix. Fixes for bug 569236 provide part one of the fix.

---

583272-1 : "Corrupted Connect Error" when using IPv6 and On-Demand Cert Auth

Solution Article: K11736022

Component: Access Policy Manager

Symptoms:
Browser shows a "corrupted connect error" when access policy runs On-Demand Cert Auth on an IPv6 virtual server.

The root cause is that in packet capture, the APM sends an HTTP 302 with invalid brackets around the hostname, like this:
Location: https://[login.example.com]/my.policy

Brackets around IPv6 addresses are for raw IPv6 addresses. They are illegal for DNS names that represent an IPv6 address.

Conditions:
IPv6 virtual server, and On-Demand Cert Auth in the access policy. Only applies if a DNS hostname is used. Raw IPv6 addresses are not affected.

Impact:
Client is unable to authenticate.

Workaround:
None.

Fix:
The brackets in the Location header were inserted if the connection was IPv6, which included both raw IPv6 addresses and DNS names representing IPv6 addresses. The logic has been changed to only insert if the connection is to a raw IPv6 address.

---

583113-3 : NTLM Auth cannot be disabled in HTTP_PROXY_REQUEST event

Component: Access Policy Manager

Symptoms:
The following iRule did not work as expected when the access profile had an NTLM auth. The client still received a 407 prompt to enter NTLM credentials.

when HTTP_PROXY_REQUEST {
    if { [HTTP::uri] contains "disable" } {
        ACCESS::disable
    }
}

Conditions:
Access profile of an SWG type, with an NTLM auth profile attached.

Impact:
It was impossible to disable NTLM auth from the HTTP_PROXY_REQUEST event.

Workaround:
The following iRule works from HTTP_REQUEST

when HTTP_REQUEST {
    if { [HTTP::uri] contains "disable" } {
        ACCESS::disable
        ECA::disable
    }
}

Fix:
When ACCESS filter is disabled, it still processes certain messages. The logic in one of those message handlers was "if NTLM configured, then wake up the ECA plugin"

Fix changed the logic to "if NTLM configured and ACCESS filter is not disabled, then wake up the ECA plugin."

---

583010-9 : Sending a SIP invite with "tel" URI fails with a reset

Component: Service Provider

Symptoms:
Using a "INVITE tel:" URI results in SIP error (Illegal value).

Conditions:
Sending a SIP "INVITE tel:" to BIG-IP does not work.

Impact:
"INVITE tel:" messages are not accepted by BIG-IP.

Workaround:
None

Fix:
An EHF will be released to address this issue. It will also be addressed in a future release.

---

582813-1 : Linux Kernel CVE-2016-0774

Solution Article: K08440897

---

582752-2 : Macrocall could be topologically not connected with the rest of policy.★

Component: Access Policy Manager

Symptoms:
It is possible to create macrocall access policy item that:

1. Belongs to policy items list.
2. Correctly connected to ending.
3. Have no incoming rules (i.e., no items pointing at it).

Conditions:
1. Create access policy with macrocall item in one of the branches.
2. Remove the item which refers to this macrocall item from AP

As a result, macrocall item remains.

Impact:
VPE fails to render this access policy.

Workaround:
Delete macrocall access policy item manually using tmsh commands.

Fix:
Any modification of access policy is not allowed if it makes any access policy item non-referenced.
At upgrade time, non-referenced access policy items are deleted. All subsequent access policy items are deleted as well. Resulting access policies can be rendered correctly by VPE. Note that only active configuration is corrected, saved configuration file (/config/bigip.conf) contains uncorrected version until any new configuration changes are done. Active configuration can be saved by explicit tmsh command ('tmsh save sys config partitions all").

---

582683-5 : xpath parser doesn't reset a namespace hash value between each and every scan

Component: Application Security Manager

Symptoms:
After a while the iRule event stops firing until the cbrd daemon is restarted.

Conditions:
The customer has a virtual server configured with an XML, along with an iRule that triggers on the XML_CONTENT_BASED_ROUTING event.

Impact:
XML content based routing does not work dependably.

Workaround:
N/A

Fix:
fixing xpath parer -- Restoring namespace declaration each time the xpath parser finishes to parse the document.

---

582526-2 : Unable to display and edit huge policies (more than 4000 elements)

Component: Access Policy Manager

Symptoms:
It takes a very long time or is not possible to display huge policies (more than 4000 elements). VPE returns server timeout error or simple halts.

Conditions:
Huge Access Policy, for example, containing 4000 or more elements.

Impact:
Unable to edit policy because VPE times out.

Workaround:
None.

Fix:
VPE loading times for APM policies is greatly improved, so displaying very large policies (for example, 4000 elements) now completes successfully.

---

582440-2 : Linux client does not restore route to the default GW on Ubuntu 15.10

Component: Access Policy Manager

Symptoms:
Default route may be deleted after network access connection is deleted on Linux Ubuntu 15.10 distribution.

Conditions:
Ubuntu 15.10, network access tunnel connect and then disconnect

Impact:
User will not be able to reach internet after disconnecting from network access.

Workaround:
If Wifi is in use then turn off and on again.
If Ethernet is used then unplugging and plugging cable again should solve the problem.

---

582029-1 : AVR might report incorrect statistics when used together with other modules.

Component: Application Visibility and Reporting

Symptoms:
When AVR is assigned to a virtual server that also has APM or Behavioral DoS, it can lead to AVR getting false readings of the activity and as result report on unexpectedly large numbers.

Conditions:
AVR Module is used together with other modules, and these module affect the traffic flow.

Impact:
AVR reports incorrect statistics: unexpectedly large numbers.

Workaround:
None.

Fix:
AVR now identifies the other modules' activity and collects the activity statistics accordingly.

---

582003-2 : BD crash on startup or on XML configuration change

Component: Application Security Manager

Symptoms:
BD crash.
out of memory XML message in the bd.log.
The BD doesn't startup and keeps crashing upon startup.

Conditions:
Many XML profiles and relatively large XML configuration.

Impact:
ASM down, machine is offline.

Workaround:
Increase the XML available memory.

Fix:
Fixed an XML memory sanity test that caused a crash when out of XML memory upon reading XML configuration.

---

581840 : Cannot manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.

Component: Device Management

Symptoms:
If trying to manage a BIG-IP version 11.6.1 or 11.6.1 HF1 with an administrator account named other than “admin”, this can fail.

Conditions:
This can occur with a BIG-IQ managing a BIG-IP version 11.6.1 or 11.6.1HF1 system with a different account than “admin”.

Impact:
You cannot manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.

Workaround:
Install 11.6.1 HF2 on the BIG-IP system, or use an administrator account named “admin” for managing the device.

Fix:
Can now manage BIG-IP version 11.6.1 or 11.6.1 HF1 through BIG-IQ.

Behavior Change:
local requests through iControl client are now made on port 80, instead of 443.

---

581835-3 : Command failing: tmsh show ltm virtual vs_name detail.

Component: TMOS

Symptoms:
The following command fails: tmsh show ltm virtual vs_name detail. The system posts the following error:

01020036:3: The requested profile exchange: virtual server object (exchange_profile_name:vs_name) was not found.

Conditions:
Occurs when an APM Access Profile has an Exchange Profile attached and the access profile is then assigned to a virtual server.

Impact:
No information is displayed by the tmsh show command.

Workaround:
None.

Fix:
The tmsh show command now presents information, and 'tmsh show ltm virtual vs_name detail' shows the expected details without error.

---

581834-4 : Firefox signed plugin for VPN, Endpoint Check, etc

Component: Access Policy Manager

Symptoms:
clients are unable to use the Firefox plugin on Firefox version 47 and above

Conditions:
Clients using Firefox v47 and above attempting to use the Firefox plugin

Impact:
Clients will be unable to use the plugin if they are using Firefox version 47 and above

Fix:
The Firefox plugin now supports all versions.

---

581829-1 : Traffic that uses a network HSM for crypto services can fail to recover.

Component: Local Traffic Manager

Symptoms:
When the system is configured to use network HSM for FIPS crypto services, all FIPS-related traffic will cease to function after the tmm daemon gets restarted, and does not recover until a restart of both pkcs11d and tmm, or a reboot of the unit.

Conditions:
-- System is configured for network HSM for FIPS crypto services.
-- tmm gets restarted.

Impact:
Traffic that relies on the network HSM for crypto services fails and does not recover.

Workaround:
Restart both pkcs11d and tmm by issuing the following command:

On a standard BIG-IP appliance:
 bigstart restart pkcs11d tmm

On a VIPRION system:
 clsh bigstart restart pkcs11d tmm

Fix:
Traffic that relies on the network HSM for FIPS crypto services now recovers as expected when tmm is restarted.

---

581770-2 : Network Access traffic does not pass IPv6 traffic if a Network Access resource contains IPv4&IPv6

Component: Access Policy Manager

Symptoms:
Network Access clients are unable to pass IPv6 traffic

Conditions:
Network Access resource configured with IPv4&IPv6
Client attempts to pass IPv6 traffic

Impact:
IPv6 traffic is dropped

Fix:
APM will now pass IPv6 traffic through the tunnel if an IPv4&IPv6 resource is configured.

---

580893-1 : Support for Single FQDN usage with Citrix Storefront Integration mode

Solution Article: K08731969

Component: Access Policy Manager

Symptoms:
Adding a new login account onto Citrix Receiver enumerates the applications and desktop. Logging off and reconnecting using the same account starts failing.

Conditions:
-- Citrix Storefront Integration mode with APM.
-- Using the same FQDN to access both Storefront as well as an APM virtual server.

Impact:
Clients are unable to connect.

Workaround:
No workaround other than using different FQDNs.

Fix:
You can now use the same FQDN to successfully access both Storefront as well as an APM virtual server.

---

580817-3 : Edge Client may crash after upgrade★

Component: Access Policy Manager

Symptoms:
The Edge client may crash after upgrading to 11.4.1 through 12.0.0.

Conditions:
Access Policy with Firewall Checker
Update BIG-IP to 12.1.0

Impact:
Users are unable to use the Edge client

Fix:
Fixed a crash in the Edge client

---

580686-1 : Hostagentd might leak memory on vCMP hosts.

Solution Article: K70973444

Component: Device Management

Symptoms:
hostagentd resident memory keeps leaking over time. Unexplained system instability. Health monitors might work intermittently.

Conditions:
This occurs when host uptime is two months or longer.

Impact:
hostagentd consumes more than 400 MB of resident memory. In some cases, the process consumes more than 1 GB. This might cause system instability and intensive usage of vCMP host swap memory.

Workaround:
Restart hostagentd on vCMP host.

Fix:
Many stability and other improvements have been made to hostagentd daemon and associated functionality, so that memory leaks on vCMP hosts no longer occur.

---

580596-9 : TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 / TMM SSL/TLS virtual server vulnerability CVE-2016-6907

Solution Article: K14190 K39508724

---

580460-1 : Client side integrity defense or proactive may break application

Component: Advanced Firewall Manager

Symptoms:
A blank page is shown when client side integrity/proactive is turned on.

Conditions:
1. Client side integrity/proactive is turned on
2. IE 11 in compatibility mode - version 8 or lower. IE6 and 7 work.

Impact:
Application is broken - blank page is shown

Workaround:
N/A

---

580429-5 : CTU does not show second Class ID for InstallerControll.dll

Component: Access Policy Manager

Symptoms:
Client troubleshooting utility does not display the registered class id of Installer control.dll.

Conditions:
Client troubleshooting utility is used to display all installed edge client components.

Impact:
No impact to end user or administrator. Impacts F5 support.

Workaround:
None.

Fix:
CTU now shows the class id of installer control.dll.

---

580421-3 : Edge Client may not register DLLs correctly

Component: Access Policy Manager

Symptoms:
After an end-user confirms that they want to install InstallerControll.cab, the browser gets stuck in 'Checking client'.

Conditions:
Client is using Internet Explorer

Impact:
Clients are unable to install the Edge client components

Fix:
Edge client components are now getting properly registered.

---

580340-3 : OpenSSL vulnerability CVE-2016-2842

Solution Article: K52349521

---

580313-3 : OpenSSL vulnerability CVE-2016-0799

Solution Article: K22334603

---

580303-3 : When going from active to offline, tmm might send a GARP for a floating address.

Component: Local Traffic Manager

Symptoms:
When moving from active to offline, tmm might send one final GARP for a floating address from the device that is moving offline.

Conditions:
Using high availability, and switching a device from active to offline.

Impact:
The GARP from the offline device can arrive on upstream devices after the GARP from the newly active device, which might poison the address cache of the upstream device. The result is that failover takes longer, since the upstream devices must rediscover the active device.

Workaround:
Use MAC masquerading along with the floating address; the system sends a GARP for the MAC masqueraded address, which prevents the issue.

Fix:
tmm no longer sends a final GARP for a floating address immediately before going offline.

---

580168-2 : Information missing from ASM event logs after a switchboot and switchboot back

Component: Application Security Manager

Symptoms:
Information missing from ASM event logs after a switchboot and switchboot back

Conditions:
ASM provisioned
event logs available with violation details
install/upgrade to another volume and switchboot to it
wait for ASM to fully come up
switchboot back
event logs are still available but violation details are gone

Impact:
Information missing from ASM event logs after a switchboot and switchboot back

Workaround:
N/A

Fix:
N/A

---

580026-3 : HSM logging error

Solution Article: K74759095

---

579975-3 : OpenSSL vulnerability

Solution Article: K79215841

---

579955-2 : BIG-IP SPDY and HTTP/2 profile vulnerability CVE-2016-7475

Solution Article: K01587042

---

579919-1 : TMM may core when LSN translation is enabled

Component: Local Traffic Manager

Symptoms:
tmm core

Conditions:
Virtual uses LSN translation with a destination matching a pool-based route

Impact:
Traffic disrupted while tmm restarts.

Fix:
Virtual with LSN translation no longer leads tmm coring when destination matches a pool-based route.

---

579909-2 : Secondary MCPD exits for APM Sandbox warning improperly treated as configuration error

Component: Access Policy Manager

Symptoms:
Secondary blade MCPD exits if APM Sandbox intends to log a warning message when it fails to remove the corresponding sandbox directory /var/sam/www/webtop/sandbox/files_d/<partition_name>_d while the user is removing the partition.

There are multiple cases that can potentially log such kind of Sandbox warning message and cause an mcpd crash and/or tmm crash. APM can log the warning if it encounters a directory which is not empty, or if the directory does not exist. You will see this error signature in /var/log/ltm:

Mar 11 11:36:49 slot2/viprion-3 warning mcpd[6022]: 010717ac:4: Configuration Warning: Cannot remove directory with symlink to sandbox for partition (p1). Error: Directory not empty. If you have access to bash shell, try to run command: rmdir /var/sam/www/webtop/sandbox/files_d/p1_d/

Conditions:
The sandbox directory corresponding to the partition that you are deleting cannot be removed due to any reason such as Not Existing, Not Empty, etc. on the secondary blade. This can occur on the secondary blades if you create a partition before provisioning APM, then delete the partition on the primary blade, and auto-sync is enabled in the device group.

Impact:
Secondary MCPD exits and blade restarts. Tmm can core. Traffic disrupted while tmm restarts.

Workaround:
N/A

Fix:
Fixed such that Secondary MCP will not exit but only log the warning message as the partition is successfully deleted.

---

579843-3 : tmrouted may not re-announce routes after a specific succession of failover states

Component: Local Traffic Manager

Symptoms:
tmrouted does not re-announce RHI routes in a specific transition of failover states within a HA pair using dynamic routing and HA pair.

Conditions:
- Active/Standby HA pair set up
 - Both units configured with a dynamic routing protocol and Route Health Injection enabled on one or more Virtual-Addresses.
 - Active unit has the following succession of failover states:
   Active->Offline->Online->Standby->Active

Impact:
Tmrouted may not announce the Virtual addresses when coming back to Active state after the mention succession.

Workaround:
A failover to Standby and back to Active works around the issue.
Restarting tmrouted is also an alternative option.

Fix:
tmrouted now re-announces RHI routes in a specific transition of failover states within a HA pair using dynamic routing and HA pair.

---

579829-3 : OpenSSL vulnerability CVE-2016-0702

Solution Article: K79215841

---

579559-2 : DTLS Networks Access may not work with some hardware platforms with Nitrox hardware acceleration

Component: Access Policy Manager

Symptoms:
Network Access always fallbacks to TLS connection even if DTLS is configured when connecting to some hardware platforms.

Conditions:
Network Access is configured to use DTLS
Hardware BIG-IP with DTLS Nitrox acceleration is used,

Impact:
Network Access connection always fallbacks to TLS connection

Workaround:
N/A

Fix:
Previously, Network Access always fell back to a TLS connection even if DTLS was configured when connecting to some hardware platforms. Network Access no longer falls back to TLS.

---

579524-2 : DBD::mysql::db do failed: Duplicate entry '/Common/xxx' for key 'name'

Component: Application Security Manager

Symptoms:
Policy Import via iControl REST in an HA pair occasionally fails on the Standby device with - DBD::mysql::db do failed: Duplicate entry '/Common/xxx' for key 'name'

Conditions:
Active/Standby pair configured
ASM provisioned
Import a security policy, via iControl REST

Impact:
Policy import fails

Workaround:
n/a

Fix:
We have fixed the import policy via iControl REST so that it does not generate the database error

---

579371-2 : BIG-IP may generate ARPs after transition to standby

Solution Article: K70126130

Component: Local Traffic Manager

Symptoms:
tmm generates unexpected ARPs after entering standby.

Conditions:
-- High availability configuration with a vlangroup with bridge-in-standby disabled.
-- ARP is received just before transition to standby.

Impact:
Unexpected ARP requests that might result in packet loops.

Workaround:
None.

Fix:
ARPs will no longer be proxied on vlangroups with bridge-in-standby disabled after entering standby.

---

579284 : Potential memory corruption in MCPd

Component: TMOS

Symptoms:
Memory in mcpd could get corrupted. The effect of this is unpredictable.

Conditions:
Varies. One way (but not the only way) this could be seen is by cancelling a chunked stats query (e.g. hitting ctrl-c during "show sys connection").

Impact:
Varies. Sometimes nothing will happen; other times MCP could start acting unpredictably. In one case it closed its connection to TMM, which caused all TMMs to restart.

Fix:
Identified and fixed areas of potential memory corruption in MCP.

---

579237-3 : OpenSSL Vulnerability CVE-2016-0705

Solution Article: K93122894

---

579220-3 : Mozilla NSS vulnerability CVE-2016-1950

Solution Article: K91100352

---

579085-4 : OpenSSL vulnerability CVE-2016-0797

Solution Article: K40524634

---

579049-1 : TMM core due to wrong assert

Component: Application Visibility and Reporting

Symptoms:
Under stress traffic tmm can core with the following backtrace:
frame 3:
in *__GI___assert_fail
frame 4 will look like this:
.... avr_alloc_segmempool_with_id .. mempool.c:278

Conditions:
AVR provision and collecting statistic.

Impact:
Traffic disrupted while tmm restarts.

Fix:
Fixed an issue that intermittently caused the TMM to core.

---

578971-1 : When mcpd is restarted on a blade, cluster members may be temporarily marked as failed

Component: Local Traffic Manager

Symptoms:
When mcpd is restarted on a blade, the clusterd process on that blade may become blocked for some time. This may result in cluster member heartbeat timeouts, which are seen in the /var/log/ltm log file with messages that include:

"Slot 1 suffered heartbeat timeout ..."

This causes cluster members to be marked failed. The condition resolves itself within one minute, and the cluster fully recovers on its own.

Conditions:
Mcpd is restarted on a blade.

Impact:
Though all blades recover on their own, the cluster members being marked fail may result in a failover.

Workaround:
There is no workaround for this issue. It is recommended to avoid restarting mcpd on any blade belonging to the active unit of an HA group. The issue resolves itself within about a minute, and all cluster members will be marked as up again.

Fix:
The clusterd daemon has been fixed to no longer become blocked when mcpd is restarted. This prevents the cluster member heartbeat timeouts from occurring, and thus no cluster members will be marked failed.

---

578844-2 : tmm cores when switching to IPv6 virtual server while connected to IPv4 virtual server with Edge Client.

Component: Access Policy Manager

Symptoms:
tmm cores when switching to IPv6 virtual server while connected to IPv4 virtual server with Edge Client.

Conditions:
NA resource with IPv4&IPv6 is used (SNAT pool in NA resource is set to None). User is connected to IPv4 Virtual server.
While connected user clicks on 'Change server' and chooses an IPv6 virtual server.

Impact:
Traffic disrupted while tmm restarts.

---

578570-2 : OpenSSL Vulnerability CVE-2016-0705

Solution Article: K93122894

---

578564-3 : ICAP: Client RST when HTTP::respond in HTTP_RESPONSE_RELEASE after ICAP REQMOD returned HTTP response

Component: Service Provider

Symptoms:
Connection aborted with RST "ADAPT unexpected state transition (old_state 22 event 7)"

Conditions:
An HTTP virtual has a request-adapt profile.
The ICAP server returns an HTTP response for REQMOD.
An iRule executes HTTP::respond in the HTTP_RESPONSE_RELEASE event.

Impact:
HTTP::respond cannot be used to modify an HTTP response returned by an ICAP server that is modifying an HTTP request.

Fix:
HTTP::respond works as expected even on an HTTP response returned by an ICAP server after request adaption.

---

578353 : Statistics data aggregation process is not optimized

Component: Application Visibility and Reporting

Symptoms:
CPU spikes may occur every 5 minutes

Conditions:
Occurs all the time

Impact:
High CPU usage may be observed every 5 minutes

Workaround:
For versions based on 11.5.4 and 11.6.0 take the following steps:

1. Edit the entry 'AggregationMode' under the /etc/avr/monpd/monpd.cfg file and set it to be 'low' instead of 'medium' or 'high'.

2.Restart Monpd afterwards.

For 12.0.0 and on:
tmsh modify sys db avr.stats.aggregation value low

Fix:
The aggregation process of statistics in DB which is done using monpd should be optimized, and skip redundant updates of tables.

---

578334-3 : Policy Import (REST, inline XML import) in HA pair (CMI) fails on the peer device, remaining with a stub (default) policy.

Component: Application Security Manager

Symptoms:
These errors are visible in asm log:
--------------------
Mar 3 20:18:33 Bip_102 crit g_server.pl[29381]: 01310027:2: ASM subsystem error (asm_config_server.pl,F5::ImportExportPolicy::Base::fatal_error): no such file '/ts/var/sync/admin~t6jsI8OQtyjKrbs2Djpjng'
Mar 3 20:18:33 Bip_102 info perl[29340]: 01310053:6: ASMConfig change: Import Policy Task Import Policy Task (1457029113.860000) [update]: Status was set to FAILURE. End Time was set to 1457029114. Message was set to Exported policy file not found!.. { audit: username = admin, client IP = 172.18.185.226 }
--------------------

The policy created on the peer device is a stub - default policy.

Conditions:
ASM provisioned
HA pair (CMI)
Policy Import (REST, inline XML import)

Impact:
Policy Import (REST, inline XML import) in HA pair (CMI) fails on the peer device, remaining with a stub (default) policy on the peer device.

Workaround:
n/a

Fix:
We have fixed the import/export mechanism on HA pair (CMI).

---

577939-1 : DNS suffixes on user's machine may not be restored correctly in some cases

Component: Access Policy Manager

Symptoms:
DNS suffixes on user's may not be restored correctly if user reboots his machine without disconnecting VPN.

This may result in incorrect or failed DNS resolution.

Conditions:
1)DNS relay proxy components is installed on user's machine
2) User reboots the machine without disconnecting VPN first

Impact:
DNS suffixes are not restored correctly, which may lead to incorrect or failed DNS resolution

Workaround:
Disconnect VPN before rebooting machine

Fix:
DNS Suffixes are now restored properly.

---

577863-2 : DHCP relay not forwarding server DHCPOFFER and DHCPACK message after sometime

Component: Policy Enforcement Manager

Symptoms:
If routing table on DHCP server is mis-configured, so that DHCP server know how to send packets to BigIP selfIP(used by BigIP DHCP relay), but does not know how to send packets to DHCP clients, DCHP client will not receive DHCP reply for unicast request and will start to broadcast DHCP renewal. After a while, BigIP will stop to relay DHCPOFFER and DHCPACK back to DHCP clients all together.

Conditions:
DHCP server unicast reply back to client is not received by client, causing DHCP client to send broadcast DHCP packets(with client's IP as source IP).

Impact:
BigIP will stop to relay DHCPOFFER and DHCPACK back
to DHCP clients

Workaround:
Fix the DHCP server routing table, so that DHCP server can deliver DHCP reply packet back to client successfully.

---

577828-5 : BIND vulnerability CVE-2016-2088

Solution Article: K59692558

---

577826-4 : BIND vulnerability CVE-2016-1286

Solution Article: K62012529

---

577823-4 : BIND vulnerability CVE-2016-1285

Solution Article: K46264120

---

577814-4 : MCPd might leak memory in PEM stats queries.

Component: Policy Enforcement Manager

Symptoms:
Memory leak may result in an "Out of Memory" condition causing functional issues in the BIG-IP.

Conditions:
Occurs when a valid PEM stats query is issued by a UI (GUI TMSH, REST, etc.) and PEM is configured on the BIG-IP.

Impact:
System may be unresponsive or crash due to being out of memory.

Workaround:
None.

Fix:
Fixed the potential MCPd memory leak in PEM stats queries.

---

577668-1 : ASM Remote logger doesn't log 64 KB request.

Component: Application Security Manager

Symptoms:
A request longer than 10 KB is truncated to 10 KB in the ASM remote logger although the remote logger is configured to log up to 64 KB requests.

Conditions:
The remote logger is configured to max request size 64k .
A request is longer than 10 KB.

Impact:
Incorrect request size in the log.

Workaround:
N/A

Fix:
ASM can now logs up to 64 KB requests. (Actual size depends on the total message size and the other fields in the message.)

---

577664-2 : Policy import, to inactive policies list, results in different policies on the sync-failover peers

Component: Application Security Manager

Symptoms:
Having a standard Active/Standby setup, with a single Sync-Failover DG, Auto-Sync, with ASM enabled.
When importing an ASM policy (named "ddddd") into the inactive policies list, the following results in GUI at -
"Security ›› Application Security : Security Policies : Inactive Policies"

On active device:
Security Policy Name - Version
ddddd - 2016-02-25 10:39:49
ddddd_2 - 2016-03-01 00:11:46

On standby device:
Security Policy Name - Version
ddddd - 2016-03-01 00:11:41
ddddd_2 - 2016-02-25 10:39:49

According to the "Version" field (time stamps), the "ddddd" on active is actually "ddddd_2" on standby and then the other two policies are not the same.

The group ends up with three different policies on the two devices.

Conditions:
Active/Standby pair
ASM provisioned
Import security policy to the inactive policies list

Impact:
Three different policies are created on the two devices.

Workaround:
n/a

Fix:
We have fixed the import policy process so that it results in consistent state on both devices in a device group.

---

577440-1 : audit logs may show connection to hagel.mnet

Component: TMOS

Symptoms:
An iControl host header is improperly formatted with the name hagal.mnet

The request is properly delivered to the correct host but contains a badly addressed host header that is ignored.

If the authorization fails for the icontrol query then the audit log will contain this destination information which may be confusing.

Conditions:
Setting up device trust exercises this code path.

Impact:
No impact to functionality but is confusing for log interpretation.

Workaround:
There is not workaround

Fix:
When this bug is fixed then the host header is properly formatted with the destination of the iControl request.

---

576591-4 : Support for some future credit card number ranges

Component: Application Security Manager

Symptoms:
ASM does not block or mask when a specific credit card number range (planned for the future) appears in the response.

Conditions:
The Data Guard feature is turned on and set to Block, Alarm or Mask. The responses contains credit card number with specific ranges.

Impact:
The traffic passes unmasked or unblocked to the end client.

Workaround:
A custom pattern is possible for these cases, but should be adjusted to each customer specifically.

---

576314-2 : SNMP traps for FIPS device fault inconsistent among versions.

Component: Local Traffic Manager

Symptoms:
The snmp traps bigipFipsDeviceError and bigipFipsFault are inconsistent among versions.

Conditions:
This trap is raised if the FIPS device firmware has stopped responding to requests and is no longer functional. The trap is different on the BIG-IP 10350 FIPS platform.

Impact:
The meaning of the trap is that the system is not able to perform any FIPS operations and process FIPS related traffic. You will need to be mindful of which version you are on to interpret the OIDs correctly.

Fix:
An SNMP trap is generated when the system has detected a FIPS device fault indicating that said device can no longer service FIPS operations. The OIDs are different across versions and one specific platform. Here is the OIDs and versions:

BIGIP-COMMON-MIB::bigipFipsDeviceError .1.3.6.1.4.1.3375.2.4.0.152
This trap means "Encountered error in the FIPS card operation" on all FIPS platforms

BIGIP-COMMON-MIB::bigipFipsFault .1.3.6.1.4.1.3375.2.4.0.156 (from v11.5.4-hf1 and 11.6.1, not 12.0.0)
BIGIP-COMMON-MIB::bigipFipsFault .1.3.6.1.4.1.3375.2.4.0.166 (from v12.1.0)
These traps mean "The FIPS card is currently in faulty state" for the specific FIPS hardware included on the BIG-IP 10350

---

576305-3 : Potential MCPd leak in IPSEC SPD stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying IPSEC SPD stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IPSEC SPD stats.

---

576296-2 : MCPd might leak memory in SCTP profile stats query.

Component: Local Traffic Manager

Symptoms:
The memory allocation for mcpd might grow by a small amount if SCTP profile stats are queried. In order to begin to impact the performance of the system, the stats would have to be queried many thousands of times.

Conditions:
An SCTP profile is configured, and the stats are displayed in TMSH or the GUI.

Impact:
Performance may be degraded.

Workaround:
None.

Fix:
Resolved a memory leak in mcpd resulting from a query of SCTP profile stats.

---

576224-1 : NetHSM does not come back after TCP connection to device is reset

Component: Local Traffic Manager

Symptoms:
NetHSM does not come back after TCP connection to device is reset.

Conditions:
TCP connection to NetHSM device is reset.

Impact:
NetHSM stops working.

Workaround:
None.

Fix:
NetHSM connectivity is restored after TCP connection to device is reset.

---

576069-2 : Rewrite can crash in some rare corner cases

Component: Access Policy Manager

Symptoms:
Rewrite can crash in some rare corner cases when some specific erroneous elements are present in an HTML content.

Conditions:
Any of the strings:

<meta http-equiv="refresh" />
<meta http-equiv="location" />
<param name="general_servername" />
<param name="wmode" />

triggers guaranteed rewrite crash.

Impact:
Web application malfunction.

Workaround:
iRule or direct fix of improper HTML tag.

Fix:
Fixed.

---

575735-2 : Potential MCPd leak in global CPU info stats code

Component: TMOS

Symptoms:
MCPd leaks memory; the umem_alloc_8 cache will grow.

Conditions:
In some cases, querying global CPU information stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying global CPU information stats.

---

575726-2 : MCPd might leak memory in vCMP interface stats.

Component: TMOS

Symptoms:
MCPd might leak memory in vCMP interface stats.

Conditions:
The memory leak occurs when viewing VCMP interface statistics.

Impact:
Over time this can cause MCPd to run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying vCMP interface stats.

---

575716-2 : MCPd might leak memory in VCMP base stats.

Component: TMOS

Symptoms:
MCPd might leak memory in VCMP base stats.

Conditions:
This occurs when looking at VCMP base statistics.

Impact:
Over time this might cause MCPd to run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying VCMP base stats.

---

575708-2 : MCPd might leak memory in CPU info stats.

Component: TMOS

Symptoms:
MCPd might leak memory in CPU info stats.

Conditions:
In some cases, querying CPU information stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying CPU information stats.

---

575671-2 : MCPd might leak memory in host info stats.

Component: TMOS

Symptoms:
MCPd might leak memory in host info stats.

Conditions:
In some cases, querying host information stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying host information stats.

---

575660-2 : Potential MCPd leak in TMM rollup stats stats

Solution Article: K50219995

Component: TMOS

Symptoms:
MCPd leaks memory so the amount of used memory will grow over time.

Conditions:
In rare cases, such as immediately after a reboot before system performance stats are populated, querying system performance stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying system performance stats.

---

575649-2 : MCPd might leak memory in IPFIX destination stats query

Component: TMOS

Symptoms:
MCPd might leak memory in IPFIX destination stats query.

Conditions:
In some cases, querying IPFIX destination stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IPFIX destination stats.

---

575631-3 : Potential MCPd leak in WAM stats query code

Component: WebAccelerator

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying WAM stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying WAM stats.

---

575626 : Minor memory leak in DNS Express stats error conditions

Solution Article: K04672803

Component: Local Traffic Manager

Symptoms:
A minor memory leak might occur in certain error conditions relating to DNS Express statistics.

Conditions:
There are no known DNS Express configurations that lead to this issue. The problem was detected through standard code review practices.

Impact:
Memory leaks might eventually lead to system reboots.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur in certain error conditions relating to DNS Express statistics.

---

575619-2 : Potential MCPd leak in pool member stats query code

Component: TMOS

Symptoms:
MCPd leaks memory; the umem_alloc_8 cache will grow.

Conditions:
In some cases, querying pool member stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying pool member stats.

---

575612-3 : Potential MCPd leak in policy action stats query code

Component: Local Traffic Manager

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying policy action stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying policy action stats.

---

575609-3 : Zlib accelerated compression can result in a dropped flow.

Component: Access Policy Manager

Symptoms:
Some compression requests would fail when the estimated compression output block was too small. Such errors deposit an error in the log similar to: Device error: n3-compress0 Zip engine ctx eviction (comp_code=2): ctx dropped.

Conditions:
A block that will not compress can generate a compression output that exceeds the estimated output block size.

Impact:
The flow that encounters the error is dropped.

Workaround:
Disable hardware accelerated compression.

Fix:
Difficult to compress requests may be dropped.

---

575608-2 : MCPd might leak memory in virtual server stats query.

Component: TMOS

Symptoms:
MCPd might leak memory in virtual server stats query.

Conditions:
In some cases, querying virtual server stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying virtual server stats.

---

575595-1 : Potential MCPd leak in eviction policy stats.

Component: TMOS

Symptoms:
The memory allocation for mcpd will grow by a small amount if a eviction policy stats are queried. In order to begin to impact the performance of the system, the stats would have to be queried many thousands of times.

Conditions:
An eviction policy is configured, and the stats are displayed in TMSH or the GUI.

Impact:
Performance may be degraded.

Fix:
Resolved a memory leak in mcpd resulting from a query of eviction policy stats.

---

575591-2 : Potential MCPd leak in IKE message stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying IKE message stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IKE message stats.

---

575589-1 : Potential MCPd leak in IKE event stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying IKE event stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying IKE event stats.

---

575587-2 : Potential MCPd leak in BWC policy class stats query code

Component: TMOS

Symptoms:
MCPd leaks memory.

Conditions:
In some cases, querying BWC policy stats can leak memory.

Impact:
MCPd might eventually run out of memory and core.

Workaround:
None.

Fix:
This release fixes the memory leak that could occur when querying BWC policy stats.

---

575571-2 : MCPd might leak memory in FW DOS SIP attack stats query.

Component: Advanced Firewall Manager

Symptoms:
MCPd might leak memory in FW DOS SIP attack stats query.

Conditions:
This occurs when looking at firewall DOS SIP stats.

Impact:
Over time this can cause MCPd to run out of memory and core.

---

575499-1 : VPN filter may leave renew_lease timer active after teardown

Component: Access Policy Manager

Symptoms:
TMM core making the system unavailable for a period of time until it comes back up.

Conditions:
When using both IPv4 & IPv6 network access resources with static IP address for IPv4 and dynamic address assignment for IPv6 tmm will core while NA tunnel is running or on NA's disconnect time.

Impact:
TMM core and bring down the system.

Workaround:
N/A

Fix:
No more stale renew_lease timer in vpn_ctx to cause TMM core.

---

575347-2 : Unexpected backslashes remain in monitor 'username' attribute after upgrade

Component: Local Traffic Manager

Symptoms:
The monitor 'username' attribute contains unexpected backslashes.

Conditions:
Upgrading from an earlier version with a configuration that contains a monitor 'username' attribute with at least one escaped backslash ('\\').

Impact:
Monitor probes contain excess backslashes which can lead to monitor failures.

Workaround:
Un-escape backslashes after upgrade by transforming '\\' sequences to '\'.

Fix:
Removed excess backslashes from monitor 'username' attribute during upgrade process.

---

575292-4 : DNS Relay proxy service does not respond to SCM commands in timely manner

Component: Access Policy Manager

Symptoms:
DNS relay proxy service may appear unresponsive when stopped/started through Service control manager and user may see a system dialog box saying "Service did not respond in a timely manner"

Conditions:
DNS relay services component of edge client is installed on user's machine

Impact:
Usability, User may think that service has failed.

Workaround:
Wait for service to respond proper status

Fix:
Service now reports correct status to service control manager immediately.

---

575170-3 : Analytics reports may not identify virtual servers correctly

Component: Application Visibility and Reporting

Symptoms:
In certain configurations, Analytics statistics on virtual server activity may not be reported correctly.

Conditions:
This occurs for virtual servers that are configured in one of these ways:

1. Two virtual servers have the same IP-Port-RouteDomain setting, but they use different protocols (such as TCP for one and UDP for the other) or different sources.

2. A virtual server is defined with a masked IP address rather than an explicit address (for example, 10.10.10.0/24).

Impact:
As a result, Analytics reports show an Aggregated Virtual Server or an incorrect one instead of displaying the correct virtual servers.

Workaround:
None.

Fix:
Correct identification of the virtual server and the activity reported in the charts is displaying to the right virtual server.

---

575027-2 : Tagged VLAN configurations with a cmp-hash setting for the VLAN, might result in performance issues.

Component: TMOS

Symptoms:
Tagged VLAN configurations with a cmp-hash setting for the VLAN, might result in performance issues.

Conditions:
This occurs when the following conditions are met:
1. Use of tagged VLANs in the configuration.
2. Change cmp-hash of the tagged VLAN.

Impact:
Throughput is lower than expected. Packets are not being hashed using the hash set in config. (This can be verified by looking at 'tmm/flow_redir_stat'.)

Workaround:
Use untagged VLANs and hypervisor side tagging.

Fix:
You can now use tagged VLAN configurations along with a cmp-hash setting for the VLAN, without compromising performance.

---

575011-4 : Memory leak. Nitrox3 Hang Detected.

Solution Article: K21137299

Component: Local Traffic Manager

Symptoms:
System exhausts available memory due to compression memory leak. Prior to running out of memory, repeatedly logs "Nitrox3 Hang Detected".

Conditions:
Compression device unavailable during creation of a new context.

Impact:
System can run out of memory.

Workaround:
Disable hardware compression using tmsh:

% tmsh modify sys db compression.strategy softwareonly

Fix:
Repaired memory leak.

---

574781-2 : APM Network Access IPV4/IPV6 virtual may leak memory

Component: Access Policy Manager

Symptoms:
Observation of performance graphs shows increasing TMM memory usage over time. Specifically, xhead and xdata caches grow over time. Additionally, the ppp_npmode_errors in the ppp stat table will increment with each leak.

Conditions:
APM virtual with Network Access configured with IPV4 and IPv6.

Impact:
Memory leakage over time leads to performance degradation and possible traffic outage.

Workaround:
No workaround short of not enabling IPv6.

Fix:
APM Network Access now correctly manages its memory resources.

---

574451-2 : ASM chassis sync occasionally fails to load on secondary slot

Solution Article: K90243258

Component: Application Security Manager

Symptoms:
ASM chassis sync occasionally fails to load on secondary slot when a new policy is created after a series of other configuration changes in quick succession.

Conditions:
A new policy is created after a series of other configuration changes in quick succession

Impact:
ASM chassis sync fails to load on secondary slot.

Workaround:
Make another system-wide configuration change, such as creating a user-defined signature, or wait until the hourly sync occurs.

Fix:
ASM chassis blades are now synchronized correctly after every policy creation.

---

574153-2 : If an SSL client disconnects while data is being sent to SSL client, the connection may stall until TCP timeout.

Component: Local Traffic Manager

Symptoms:
If an SSL connection gracefully begins to disconnect at the same time as data is being encrypted by SSL acceleration hardware, the connection will remain open until the TCP profile timeout occurs instead of being closed immediately. This can cause unwanted higher memory usage, possibly causing crashes elsewhere.

Conditions:
* A virtual server with ClientSSL or ServerSSL profile.
* BIG-IP SSL acceleration hardware.
* While an SSL record is being encrypted by SSL accelerator hardware, the SSL connection begins to close by client TCP FIN or by any iRule command that closes the connection.

Impact:
There is a potential for higher memory usage, which in turn may cause TMM crash due to memory exhaustion resulting in service disruption.

Workaround:
If the affected SSL traffic does not include any long idle periods, memory consumption can be mitigated by reducing the idle timeout of the TCP or SCTP profile.

Fix:
SSL connections now disconnect normally if a disconnect attempt occurs while data is being encrypted by SSL acceleration hardware.

---

574116-2 : MCP may crash when syncing configuration between device groups

Component: TMOS

Symptoms:
mcpd on the sync target crashes when syncing configuration.

Conditions:
This can occur when a local non-synced object references an object that is synced (such as a local-only virtual server referencing a synced iRule), and a non-synced object on the target machine happens to be referencing the same synced object. In this condition, mcpd could crash if objects in a sync group are deleted and synced.

Impact:
Outage due to mcp crash which causes tmm to restart.

Workaround:
When you have devices with local-only resources that are referencing objects contained in a sync/failover group, avoid deleting any objects (such as iRules) that might be referenced by other local-only resources on other devices. Instead of a "this object is in use error", mcpd on the target machine will crash.

Fix:
Verify existence of rule objects when validating configuration.

---

574055-3 : TMM crash after changing raccoon log level

Component: TMOS

Symptoms:
TMM crashes after changing the raccoon log level to debug2

Conditions:
Debug level is set to debug2 while tmm is passing traffic

Impact:
Traffic disrupted while tmm restarts.

Workaround:
set debug level to INFO

Fix:
A tmm crash related to changing the debug level while passing traffic has been fixed.

---

574052-2 : GTM autoconf can cause high CPU usage for gtmd

Component: Global Traffic Manager

Symptoms:
The autoconf feature of GTM can cause high CPU utilization (~90%) under certain situations.

In large configurations of LTM vses that contain "." (dot) in the name.

Conditions:
Large configuration of LTM VS that contain "." in the name have the name converted ("." is replaced by "_") and the LTM VS name is saved to the config.

This causes the matching algorithm in autoconf to spend many CPU cycles walking the list of VS to find a match.

This problem is caused by large numbers of VSes on a GTM Server. (10k VSes on 10k Server is less of an issue
than 10k VSes on 1 GTM Server)

Impact:
CPU usage is high, which may impact monitoring and LB decisions.

Workaround:
There are some mitigations. The preferable (for performance
and stability) are listed first.

1. Rename the virtual servers on the LTM to remove the "."
   This would require deleting the GTM configuration and
   rediscovering it and recreating pools.

2. Turn off autoconf.
   Run autoconf once to populate the config, then turn it
   off.

3. Reduce the frequency of autoconf. It will still cause
   a high CPU usage scenario, but it will be less frequent.

Versions 12.0.0 and higher do not convert the "." to "_". So that problem is eliminated for new configurations.
If a customer upgrades to 12.0.0 and the config still contains VS names that were previously converted, they still may run into high CPU usage.
Upgrading to 12.0.0 alone does not fix this issue, a reconfig would be necessary.

Fix:
Change algorithm used to match LTM VS names to GTM VS to reduce linear walk of all VSes on a server.

---

574045-2 : BGP may not accept attributes using extended length

Component: TMOS

Symptoms:
If a BGP peer sends a path attribute using the "extended length" flag and field, the attribute may be rejected and the BGP connection terminated.

Conditions:
Neighbor sends path attributes using extended length.

Impact:
The BGP adacency will repeatedly bounce and the RIB will never converge.

Fix:
Received BGP attributes using extended length are no longer rejected.

---

574020-4 : Safenet HSM installation script fails to install successfully if partition password contains special metacharacters (!#{}')

Component: Local Traffic Manager

Symptoms:
Safenet HSM installation script fails to install successfully if partition password contains special metacharacters (!#{}').

Conditions:
This issue occurs when the following conditions are met:

-- Safenet HSM installation.
-- Password contains special metacharacters (!#{}').

Impact:
Script fails to work properly, and fails to properly install/configure the HSMs, requiring manual intervention. Performing the operation manually is very complex, because the user must account for both tmsh and shell quoting, which the some user environments might not have.

Workaround:
Change password, or manually run tmsh command to define the /sys crypto fips external-hsm object (using proper shell quoting).

Fix:
Safenet HSM installation script install now completes successfully if partition password contains special metacharacters (!#{}').

Note: When using passwords with non-alphanumeric characters, make sure that they are escaped correctly, so that bash does not attempt to reinterpret or expand the password.

---

573778-7 : QEMU vulnerability CVE-2016-1714

Solution Article: K75248350

---

573764-3 : In some cases, only primary blade retains it's statistics after upgrade on multi bladed system

Component: Application Visibility and Reporting

Symptoms:
Statistics from the primary blade remain after upgrade, but not from the other blades.

Conditions:
Upgrade to new version in multi bladed system.

Impact:
Not all statistics are present after upgrade.

Workaround:
No workaround

---

573643-2 : flash.utils.Proxy functionality is not negotiated

Component: Access Policy Manager

Symptoms:
Access to some field names of classes inherited from flash.utils.Proxy is broken.

Conditions:
Presence of flash.utils.Proxy descendants.

Impact:
Customer application malfunction.

Workaround:
None.

---

573581-4 : DNS Search suffix are not restored properly in some cases after VPN establishment

Component: Access Policy Manager

Symptoms:
Modified DNS suffix after VPN establishment and closure may result in failure to resolve some DNS names

Conditions:
DNS Relay proxy service is stopped in the middle of VPN session.
User's machine is rebooted.

Impact:
DNS suffixes are not restored properly which may lead to incorrect resolution of certain DNS names.

Workaround:
Any of the following workarounds
1) Do not stop DNS relay proxy service in the middle of a VPN session
2)Restore DNS search suffixes manually.

---

573429-1 : APM Network Access IPv4/IPv6 virtual may leak memory

Component: Access Policy Manager

Symptoms:
Observation of performance graphs shows increasing TMM memory usage over time. Specifically, connflow and tunnel_nexthop caches grow over time.

Conditions:
APM virtual with Network Access configured with no SNAT and both IPV4 and IPV6 enabled.

Impact:
Memory leakage over time leads to performance degradation and possible traffic outage.

Workaround:
No workaround short of not enabling IPv6 support.

Fix:
Network Access now correctly manages its memory resources.

---

573406-3 : ASU cannot be completed if license was last activated more than 18 months before

Component: Application Security Manager

Symptoms:
Attack Signature Update (ASU) if license was last activated more than 18 months before.

Conditions:
The license was last activated more than 18 months before.

Impact:
Attack SIgnature Update (ASU) cannot be performed.

Workaround:
The license must be re-activated.

Fix:
Attack Signature Update (ASU) can now be completed based on a license retrieved from server.

---

573402-2 : "C_GetAttributeValue error" with netHSM

Component: Local Traffic Manager

Symptoms:
When netHSM is used with BigIP, sometimes you will see "C_GetAttributeValue error".

Conditions:
When netHSM is used, this error message may appear.

Impact:
This message is benign and can be ignored.

Workaround:
This error message is not harmful. User can ignore them in the log.

Fix:
When netHSM is used, the benign 'C_GetAttributeValue error' messages are no longer posted.

---

573343-3 : NTP vulnerability CVE-2015-8158

Solution Article: K01324833

---

573124-2 : TMM vulnerability CVE-2016-5022

Solution Article: K06045217

---

573075-2 : ADAPT recursive loop when handling successive iRule events

Component: Service Provider

Symptoms:
After the first iRule resumes from being parked, ADAPT attempts to process the second iRule event repeatedly.
The connection is aborted with RST cause "ADAPT unexpected state transition".
The adapt profile statistic "records adapted" reaches a very high number as it counts every attempt.

Conditions:
A requestadapt or responseadapt profile is configured.
An iRule is triggered on the ADAPT_REQUEST_RESULT or ADAPT_RESPONSE_RESULT event, that parks.
The modified headers (from an ICAP server) arrive at the ADAPT filter while the first event is parked.
Any iRule on the ADAPT_REQUEST_HEADERS or ADAPT_RESPONSE_HEADERS event does not park.

Impact:
The connection is aborted with RST cause "ADAPT unexpected state transition".
The statistic "records adapted" reaches a very high number.
Eventually the TMM crashes and the Big-IP fails over.

Workaround:
If possible, arrange the iRules to avoid the conditions above.
In particular, if there is no better way, it is possible to avoid this if there is an iRule on the ADAPT_REQUEST_HEADERS or ADAPT_RESPONSE_HEADERS event that parks.

Fix:
ADAPT correctly processes successive iRule events exactly once for each adaptation, and the "records adapted" statistic reports the correct number.

---

572922-2 : Upgrade causes an ASM subsystem error of PL_PARAM_ATTRIBUTES.★

Component: Application Security Manager

Symptoms:
The following error is produced in ASM log during upgrade:
-----------
ASM subsystem error (ts_configsync.pl,F5::DbUtils::insert_data_to_table): Row <some_row_id> of table <some_db_table_name> is missing <some_field_name> (DDD) -- skipping F5::<some_package_name>
-----------

Conditions:
ASM provisioned

Impact:
Different portions of the security policy may be incorrectly upgraded.

Workaround:
N/A

Fix:
We have fixed the root cause so that the following error does not reproduce upon upgrading:
ASM subsystem error (ts_configsync.pl,F5::DbUtils::insert_data_to_table): Row <some_row_id> of table <some_db_table_name> is missing <some_field_name> (DDD) -- skipping F5::<some_package_name>

---

572887-2 : DNS doesn't work properly on Ubuntu 15.10 when using f5fpc CLI client

Component: Access Policy Manager

Symptoms:
DNS doesn't work properly on Ubuntu 15.10 when using f5fpc CLI client. This happens because f5fpc fails to patch /etc/resolv.conf on Ubuntu 15.10 release.

Conditions:
/etc/resolv.conf, Ubuntu 15.10, f5fpc CLI client and network access establishment.

Impact:
DNS doesn't work properly on Ubuntu 15.10

Fix:
Now DNS works fine on Ubuntu 15.10 because /etc/resolv.conf can be patched correctly now by f5fpc command line client.

---

572885-2 : Policy automatic learning mode changes to manual after failover

Component: Application Security Manager

Symptoms:
Policy automatic learning mode changes to manual when a failover occurs.

Conditions:
ASM provisioned.
Device group w/ ASM policy sync configured.
ASM Policy is in automatic learning mode.
A failover occurs.

Impact:
The policy changes from automatic learning mode to manual.

Workaround:
None.

Fix:
Policy automatic learning mode no longer changes to manual when a failover occurs. Automatic learning mode will now be disabled only in active/active configurations.

---

572563-3 : PWS session does not launch on Internet Explorer

Component: Access Policy Manager

Symptoms:
Internet Explorer (IE) gets stuck entering Protected Work Space (PWS).

Conditions:
One of the DLLs provided by APM, vdeskctrl.dll, provides COM services. Internet Explorer (IE), consumes the COM services. The DLL is loaded by IE during upgrade of PWS components. For some reason (especially on slow systems), IE does not unload the the old DLL promptly after upgrading PWS. When COM services are invoked to initialize PWS after upgrade, old DLL provides the service. Due to the recent renewal of our signing certificate, old DLL can't certify the integrity of the new PWS components. We have researched the issue, but we have not found a way to instruct IE to unload the old DLL after upgrade.

Impact:
PWS session does not launch.

Workaround:
After upgrade, if Internet Explorer(IE) does not enter into PWS within 60 seconds, close IE and start a new session. This is an one time event.

Fix:
Internet Explorer can now launch a Protected Workspace session.

---

572543-2 : User is prompted to install components repeatedly after client components are updated.

Component: Access Policy Manager

Symptoms:
After auto-update of client components from internet explorer, user will be prompted to install components again if he goes to VPN site again.

Conditions:
Administrator upgrades big-ip to 12.1.
User has client components from a release older than 12.1

Impact:
User is prompted to install components again and again

Workaround:
Restart browser after components are updated the first time.

---

572495-3 : TMM may crash if it receives a malformed packet CVE-2016-5023

Solution Article: K19784568

---

572281-2 : Variable value in the nesting script of foreach command get reset when there is parking command in the script

Component: Local Traffic Manager

Symptoms:
When there is something like the following script:

foreach a [list 1 2 3 4] {
   set a 10
   after 100
}

There is parking command, after, in the script and it runs after "set a 10", when after command returns, the value of a goes back to the initial value set in the foreach, value of 10 is lost.

Conditions:
There is parking command in the nesting script of foreach. For more information on commands that park, see K12962: Some iRule commands temporarily suspend iRule processing at https://support.f5.com/csp/#/article/K12962

Impact:
Variable values get reset.

Workaround:
Set(or set again) the variable value after the parking command.

Fix:
Will fix in later release.

---

572224-4 : Buffer error due to RADIUS::avp command when vendor IDs do not match

Component: Service Provider

Symptoms:
Errors similar to the following in the ltm log:

err tmm3[21915]: 01220001:3: TCL error: /Common/RadiusTest CLIENT_DATA - Buffer error (line 1) (line 1) invoked from within 'RADIUS::avp 26 ip4 index 0 vendor-id 12345 vendor-type 6'.

Conditions:
The issue happens when there is a RADIUS::avp command for a vendor specific AVP and there's a RADIUS request that contains a different vendor-id than what was specified in the iRule command.

Impact:
You are unable to use vendor-specific RADIUS AVP commands

Workaround:
None.

Fix:
Vendor-specific RADIUS AVP commands no longer generate errors.

---

572133-2 : tmsh save /sys ucs command sends status messages to stderr

Component: TMOS

Symptoms:
When you run the tmsh save /sys ucs command, some normal status messages are being sent to stderr instead of stdout. This will be seen if a you are watching stderr for error messages.

Conditions:
There are no conditions, every time the command is run, it will send some status type messages to stderr.

Impact:
If a script runs the command it may report that the save failed because messages were send to stderr.

Workaround:
You can ignore the message "Saving active configuration..." being sent to stderr. It is not an error.

Fix:
The command will send the status messages to stdout.

---

572086 : Unable to boot v11.6.0 on 7250 or 10250 platforms

Solution Article: K49725838

Component: TMOS

Symptoms:
Unable to boot or system constantly rebooting.

Conditions:
Booting into v11.6.0 on 7250 or 10250 platform with RAID disk layout.

Impact:
Unable to boot.

Workaround:
None.

Fix:
This version of the software boots boots correctly on 7250 or 10250 platforms with RAID disk layout.

---

572025-2 : HTTP Class profile using a path selector upgrade to a policy that does not match the entire path★

Component: Local Traffic Manager

Symptoms:
If you upgrade to version 11.4.0 through 12.0.0, and your configuration contains a HTTP Class profile containing a paths selector, the generated policy does not match.

Conditions:
A HTTP Class profile containing a paths selector.

Impact:
The generated policy does not match the same paths as original HTTP Class profile.

Workaround:
Manually edit resulting policy

Fix:
The path selector specifier is no longer added to the generated policy allowing the entire http-uri to matched.

---

572015-3 : HTTP Class profile is upgraded to a case-insensitive policy★

Component: Local Traffic Manager

Symptoms:
If you upgrade to version 11.4.0 through 12.0.0, and your configuration contains a HTTP Class profile, the generated policy will be case-insensitive.

Conditions:
HTTP Class profile

Impact:
Generated policy does not match on the same conditions as original HTTP Class profile.

Workaround:
Manually edit generated policy

Fix:
The case-sensitive attribute is added to generated policies during upgrade.

---

571573-2 : Persistence may override node/pmbr connection limit

Solution Article: K20320811

Component: Local Traffic Manager

Symptoms:
In certain circumstances the BIG-IP system may load balance connections to a node or poolmember over the configured connection limit.

Conditions:
- Node or pool member configured with connection limit.
- L4 or L7 virtual server.
- Persistence configured on the Virtual Server.
- Very high load on unit.

Impact:
BIG-IP system may load balance connections to a node or pool member over the configured connection limit.

Workaround:
Remove persistence or use another method of limiting the connections (rate limiting or connection limit on the Virtual Server).

Fix:
The BIG-IP system now correctly enforces the pool member/node connection limit.

---

571344-3 : SSL Certificate with special characters might cause exception when GUI retrieves items list page.★

Component: TMOS

Symptoms:
After upgrading, unable to view certain certs from gui. Catalina.out file could contain the signature MalformedByteSequenceException: Invalid byte 2 of 3-byte UTF-8 sequence.

iControl SOAP methods
====================
Management::KeyCertificate::get_certificate_list and get_certificate_list_v2 will return an exception if returning a certificate with special characters.

Conditions:
SSL Certificate with special characters might cause exception when GUI retrieves items list page. This has been observed on upgrades to BIG-IP version 11.5.4 through 12.0.0.

Impact:
The GUI does not display the page containing certificate information. iControl SOAP cannot return a list of certificates if they contain information with special characters.

Workaround:
None.

Fix:
The GUI now correctly displays certificates with special characters, and iControl SOAP methods Management::KeyCertificate::get_certificate_list and get_certificate_list_v2 no longer return exceptions.

---

571210-4 : Upgrade, load config, or sync might fail on large configs with large objects.

Component: TMOS

Symptoms:
Attempting to load a large config with large objects may result in the following error message:

err mcpd[7366]: 01070710:3: Database error (52), Can't write blob data, attribute:implementation status:52 - EdbBlobData.cpp, line 57

Attempting to synchronize a large change may result in the following error messages and a crash of the MCPD process:

err mcpd[8210]: 01071693:3: Incremental sync: Caught an exception while adding a transaction to the incremental config sync cache: unexpected exception.

err mcpd[8210]: 01070734:3: Configuration error: MCPProcessor::processRequestNow: Can't write blob data, attribute:msgs status:52

err mcpd[8210]: 01070596:3: An unexpected failure has occurred, request_group destroyed while processing, exiting...

Conditions:
The config must be approximately 19.75 MB (slightly less) prior to processing a large object in the config that exceeds 256 KB.

Or, once config exceeds 19.75 MB and 2 MB of additional memory has been allocated, processing config objects that exceed 256 KB (the larger, the more likely to occur) lead to the error.

Impact:
Upgrade, load config, or sync might fail, and a system crash and restart might occur.

Workaround:
Stagger the load, or reduce the size of particularly large objects within a config.

Fix:
Memory handling is improved so that large configs with large objects now successfully complete upon upgrade, load config, or sync.

---

571183-2 : Bundle-certificates Not Accessible via iControl REST.

Component: Local Traffic Manager

Symptoms:
Bundle-certificates Not Accessible via iControl REST.

Conditions:
This occurs when using iControl REST to look at bundle certificates via /mgmt/tm/sys/file/ssl-cert/~Common~ca-bundle.crt/bundle-certificates

Impact:
Unable to get data from the command.

Workaround:
If you do not need to do it via iControl REST, you can view bundle certificates using the tmsh command tmsh list sys file ssl-cert ca-bundle.crt bundle-certificates

Fix:
The iControl rest command for viewing bundle-certificates now displays all of the certificates.

---

571090 : When BIG-IP is used as SAML IdP, tmm may restart under certain conditions

Component: Access Policy Manager

Symptoms:
tmm restarts.

Conditions:
It is not known exactly what the conditions are, but this occurs when BIG-IP is configured as SAML IdP.

Impact:
Tmm may restart.

Workaround:
None

---

571019-3 : Topology records can be ordered incorrectly.

Component: TMOS

Symptoms:
Topology records can contain missing order numbers, duplicate order numbers, and differences in the ordering of topology records on BIG-IP's in a sync group.

Conditions:
When adding or deleting topology records or modifying the order of existing topology records, the resulting ordering of the topology records can be inconsistent. This can lead to ordering issues including differences in the ordering of topology records on BIG-IP's in a sync group.

Impact:
It is difficult to manage the order of topology records. Topology records are evaluated in different orders on different BIG-IP's in a sync group.

Workaround:
None.

Fix:
Topology records are now ordered consistently.

---

571003-1 : TMM Restarts After Failover

Component: Access Policy Manager

Symptoms:
TMM generates core file and restarts.

Conditions:
1. In a HA pair running pre 11.5.3-HF2 or 11.6.0-HF6, the standby is upgraded to 11.6.0-HF6 EHF 186, 241, 243, or 247.
2. Force failover.
3. A new session is established or an existing session terminated.

Impact:
Serivce is disrupted. All existing sessions are terminated.

Workaround:
None.

Fix:
TMM no longer generates core file and restarts upon upgrade.

---

570973-2 : L7 hardware syn cookie feature is broken in BIG-IP v12.0.0 hf1 and hf2

Component: TMOS

Symptoms:
In BIG-IP v12.0.0 hf1 and hf2 hardware syn cookie feature for L7 (e.g. Standard Virtual Server type or FastL4 with http profile) virtual server is broken due to HSB bitstream update with a new hardware syn cookie algorithm. It does not impact 12.0.0 base release.

Conditions:
Hardware syn cookie is enabled (which is the default setting) on L7 virtual server.

Impact:
When syncookie protection is triggered, ingress legitimate traffic may be dropped by BIG-IP.

Workaround:
Disable hardware syn cookie on L7 virtual servers.

Note: After this workaround you may encounter Bug ID 555020 SW syncookies and windowscaling will cause 3WHS to fail on L7 VIP in which case you would need to apply the workaround from that as well.

Fix:
This bug is fixed in 12.0.0-hf3 and 12.1.0.

---

570926-1 : Provide a way to configure where in payload the CSPM JS is injected.

Component: Application Visibility and Reporting

Symptoms:
This is an enhancement that allows you to choose where in the document the CSPM script will be injected.

Conditions:
You are using some application that can't read the document if something appears after closing the html tag.

Impact:
Today we append the CSPM payload (for client latency measurements) at the end of the HTML document (after the html tag).
This works in browsers but it's not compliant to the HTML standard and may break some applications that rely on this standard (not browsers).

Workaround:
Un-checking "Page Load Time" in analytics profile.

Fix:
Verify that script was injected to the chosen location in the returned document.

---

570881-4 : IPsec configuration mismatch in IKEv2 causes TMM crash in isakmp_parse_proposal ()

Component: TMOS

Symptoms:
crash (NULL pointer access)

Conditions:
IPsec configuration mismatch in IKEv2 (for initiator and responder)

Impact:
Traffic disrupted while tmm restarts.

Workaround:
use correct configuration

Fix:
Proper reaction (connection reject) was added for improper configuration.

---

570818-2 : Address lease-pool in IKEv2 might interfere with IKEv2 negotiations.

Component: TMOS

Symptoms:
LTM IPsec IKEv2 does not support dynamic remote-address CONFIG option, but still might potentially process that information sent by third-party devices. The configuration changes from this option might affect traffic-selector selection in IKEv2 negotiations, leading to wrong matching results and failure in establishing IPsec SA.

Conditions:
Certain third-party vendor devices are the remote IKEv2 peer, for example, a CISCO APIC device.

Impact:
Failure in establishing IPsec SA.

Workaround:
None.

Fix:
Address lease-pool in IKEv2 no longer interferes with IKEv2 negotiations.

---

570716-3 : BIG-IP IPsec IKE peer listener vulnerability CVE-2016-5736

Solution Article: K10133477

---

570667-16 : OpenSSL vulnerabilities

Solution Article: K64009378

---

570663-3 : Using iControl get_certificate_bundle_v2 causes a memory leak

Component: TMOS

Symptoms:
Using iControl call get_certificate_bundle_v2() causes a memory leak. iControlPortal memory use grows unbounded every time the method is called.

Conditions:
This occurs anytime the method is invoked; BIG-IP devices managed by Enterprise Manager can be especially impacted.

Impact:
Eventually iControlPortal will run out of memory and crash.

Fix:
The memory leak issue has been fixed.

---

570640-2 : APM Cannot create symbolic link to sandbox. Error: No such file or directory

Component: Access Policy Manager

Symptoms:
The user may encounter the following configuration error when adding a new APM sandbox-contained object in a non-default partition (other than /Common) if the user has ever attempted (but failed) to delete this partition (for example, couldn't delete it because it was not empty).

01070734:3: Configuration error: Cannot create symbolic link to sandbox. Error: No such file or directory. If you have access to bash shell, try to run command: ln -s /config/filestore/files_d/p1_d/sandbox_file_d /var/sam/www/webtop/sandbox/files_d/p1_d/sandbox_file_d. Then try to upload file again.
Unexpected Error: Validating configuration process failed.

Conditions:
The user has ever attempted (but failed) to delete the partition.

Impact:
No more APM sandbox object such as Hosted-Content can be added to the partition.

Upgrade may fail to install configuration with the impacted sandbox object.

Workaround:
Manually use the shell command 'mkdir -p' to re-create the missing folder where the symbolic link is suppsed to be created as shown in the error message.

Directories are: {to do mkdir -p)
/config/filestore/files_d/OUTSIDE_PROD_d/sandbox_file_d
/var/sam/www/webtop/sandbox/files_d/OUTSIDE_PROD_d/sandbox_file_d
After creating the directors sync to active unit.

---

570617-4 : HTTP parses fragmented response versions incorrectly

Component: Local Traffic Manager

Symptoms:
When a fragmented response is parsed by HTTP, the version field may be incorrectly bounded. HTTP correctly determines the version of the response. However, other filters that re-scan the version field might see a truncated value. The filters then miss-parse the HTTP version.

Conditions:
A fragmented response where the HTTP version field appears in multiple packets. Another filter, for example VDI, re-scans the HTTP version field.

Impact:
The detected version of HTTP may be incorrect. Typically, the response is detected as a HTTP/0.9 response rather than the 1.0 or 1.1 response it actually uses.

Workaround:
None.

Fix:
HTTP correctly bounds the response version for other filters to parse.

---

570563-2 : CRL is not being imported/exported properly

Solution Article: K35470551

Component: Access Policy Manager

Symptoms:
CRL assigned as part of Machine Cert Auth is not being imported/exported properly.

Conditions:
This occurs when importing SSL Certificates and Keys using the CRL type. Or when adding the Machine Cert Check agent to import an Access Profile in when creating a New Certificate Authority Profile.

Impact:
Prevents CRL from being exported. Might also impact the import/export of Certificate Authority Profiles.

Workaround:
1. Copy and install the CRL to the other BIG-IP system separately.
2. Modify the exported configuration to use CRL from step 1

Fix:
Import and export of CRL is fully supported.

---

570535 : Multiple Kernel Vulnerabilities

Solution Article: K15685 K15912 K31300371 K16011 K21632201 K31026324 K17239 K17543 K17121 K41739114 K17246 K17458 K17244 K17245 K90230486 K17309 K17307 K31026324 K94105604

---

570419-2 : Use of session DB on multi-process appliances and blades may core.

Component: TMOS

Symptoms:
On selected devices and blades, tmm runs multiple processes. When running multiple processes, the session DB may occasionally attempt an operation that will cause a tmm segfault.

Conditions:
In order to experience this failure, tmm must be running in multiple processes on the appliance or on the blade, and session DB usage is required with mirroring.

Impact:
Outage and restart of tmm. This applies when bringing up blades as well as bringing peers online.

Workaround:
None.

Fix:
Use of session DB on multi-process appliances and blades no longer cores when bringing up blades as well as bringing peers online.

---

570363-2 : Potential segfault when MRF messages cross from one TMM to another.

Component: Service Provider

Symptoms:
Potential segfault when Message Routing Framework (MRF) messages cross from one TMM to another.

Conditions:
This issue occurs when MRF messages travel from one TMM to another, and an asynchronous operation also occurs (like persistence).

Impact:
It is possible for the message object to be removed before the asynchronous operation completes. If this occurs, a segfault may occur and the system might restart.

Workaround:
None.

Fix:
This release corrects the issue of potential segfault occurring when MRF messages cross from one TMM to another.

---

570064-3 : IE gives a security warning asking: "Do you want to run ... InstallerControll.cab"

Component: Access Policy Manager

Symptoms:
When logging into a VPN connection using Internet Explorer, Internet Explorer may prompt "Do you want to run ... InstallerControll.cab"

Conditions:
BIG-IP APM configured and is accessed by Internet Explorer. This can happen after an upgrade of BIG-IP.

Impact:
The prompt should not occur.

Fix:
Internet Explorer will no longer prompt to run InstallerControll.cab

---

570057-3 : Can't install more than 16 SafeNet HSMs in its HA group

Component: Local Traffic Manager

Symptoms:
With installation script on the BIG-IP, you can't install more than 16 SafeNet HSMs in its high availability group with versions 5.2 and 5.4.

Conditions:
Attempt to install more than 16 SafeNet HSMs.

Impact:
Installer script failure.

Workaround:
The limit is set by SafeNet. Currently, with F5-supported 5.2 and 5.4 client software, SafeNet doesn't allow more than 16 HSMs in one high availability configuration.

Fix:
Updated SafeNet installation scripts by replacing "vtl" to "lunacm" for high availability group creation and member adding operations for version 6.2.

---

570053-2 : HA peer's certkeychain of clientssl profile is unexpectedly either removed or re-named after config sync.

Solution Article: K78448635

Component: TMOS

Symptoms:
HA peer's certkeychain of clientssl profile is unexpectedly either removed or re-named after config sync.

Conditions:
The issue is seen when all the below conditions are met.
1. When more than one certkeychains are configured in the clientSSL profile.
2. When the content of a certkeychain of the clientSSL profile is modified. For example, "modify ltm profile client-ssl a4 cert-key-chain modify { default { cert rsa.crt key rsa.key } }".
3. Performs config sync in HA setup.

Impact:
Missing certkeychain of a clientSSL profile can result in its inability to handle some kind of SSL traffic. For example, if the clientSSL originally has EC key/cert but loses it, then it is no longer able to handle SSL connection using EC cipher suites.

Workaround:
Basically reconfigure certkeychain but avoid modifying the content.
1. On any BIG-IP system, leave only the RSA certkeychain in the clientSSL profile, just like the default configuration.
2. Config sync, so that both systems have only the RSA certkeychain.
3. In any BIG-IP system, add certkeychains for other types (EC or DSA) you need. You can "add" or "delete" but do not "modify" any existing certkeychain.
4. Do config sync, so that both systems have the same certkeychains in the clientSSL profile.

---

569972-2 : Unable to create gtm topology records using iControl REST

Component: Global Traffic Manager

Symptoms:
The user is unable to create gtm topology records using iControl REST.

Conditions:
This occurs when a user issues an iControl REST POST command for a gtm topology record.

Impact:
The iControl REST POST command fails with the following error: 'Topologies must specify both regions: ldns: server:'.

Workaround:
Use TMSH, iControl SOAP, or the GUI to create gtm topology records.

Fix:
You can now create gtm topology records using iControl REST.

Please be sure to format the gtm topology oid string using the following rules:

1) Use only a single space between each item in the topology string.
2) Use a fully-pathed name for datacenter, isp, region, and pool objects.

For example:
"ldns: subnet 11.11.11.0/24 server: datacenter /Common/DC".

---

569958-2 : Upgrade for application security anomalies

Component: Application Visibility and Reporting

Symptoms:
If upgrading to newer version, old statistics for application security anomalies are not shown.

Conditions:
Upgrade from BIG-IP version older than 12.1.0 to newer version

Impact:
Losing old statistics for application security anomalies

Fix:
Upgrade to newer version and verify that old statistics are shown.

---

569642-4 : Deleting all routes on a unit with a mirroring fastL4 Virtual may cause TMM to core

Component: Local Traffic Manager

Symptoms:
In certain circumstances TMM may core if an HA pair configured with mirroring has all the routes to the server pool removed.

Conditions:
- HA pair.
 - FastL4 VIP with mirroring.
 - default route to pool via an intermediate router.
 - The active unit is handling traffic.
 - Active unit fails over and loses its mirroring connection.
 - Prior active unit comes back and HA connection is reestablished.
 - During the loss of HA and its recovery the now active unit loses its only route to the pool member.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not remove all routes to poolmembers. If this is needed please create other backup routes prior to the deletion.

Fix:
TMM no longer cores on deleting all routes on a unit with a mirroring fastL4 Virtual during HA connection loss and recovery.

---

569634 : Aced process is not able to listen to port 6000

Component: TMOS

Symptoms:
When Aced process cannot listen to the port, it aborts and causes core dump to be produced.

Conditions:
In certain scenarios, an exiting instance of aced process does not perform a proper cleanup of the socket(listening of port 6000) and does not exit completely and the new instance of aced wont be able to listen to it.

Impact:
Aced process keeps crashing repeatedly.

Fix:
Aced process is fixed in order to explicitly close the socket file descriptor during exit. The new instance will be able to listen to that port.

---

569583-1 : Secondary Blade Rejects All Traffic after being added to the chassis★

Component: Application Security Manager

Symptoms:
After an upgrade ends in errors, the device may be left in a state that it erroneously believes to still be in the middle of the upgrade.

Conditions:
A second blade is installed into a chassis and there are errors as it comes up.
System configuration is never successfully loaded. This can occur during upgrades to versions prior to 12.0.0.

Impact:
Secondary blade blocks all ASM traffic.

Workaround:
1) Delete the /var/ts/var/install/ucs_install.pid file on all blades
2) Push a fresh sync from a good device.

Fix:
The system correctly detects that it is no longer in the middle of an upgrade.

---

569521-4 : Invalid WideIP name without dots crashes gtmd.

Component: Global Traffic Manager

Symptoms:
If a user creates a WideIP or WideIP Alias with a name that does not contain a dot, gtmd crashes.

The symptom is a crash and core dump from gtmd.

Conditions:
This occurs when the following conditions are met:
-- FQDN validation is suppressed by the following setting: gtm global-settings general domain-name-check == 'none'.
-- User attempts to create a WideIP with a name that does not contain a dot.

Impact:
gtmd crashes and WideIPs do not function.

Workaround:
When creating a WideIP or WideIP Alias while FQDN validation has been disabled (by setting gtm global-settings general domain-name-check == 'none'), make sure that the WideIP or WideIP Alias name contains at least one dot, and follows these rules:
-- The name must not end with a dot.
-- The name must not begin with a dot, unless '.' is the entire name.
-- The name contains no consecutive dots.

Fix:
FQDN now validates to confirm that a WideIP or WideIP Alias name has at least one dot in an appropriate position, and has no consecutive dots, so there is no crash and core dump from gtmd. This validation occurs even when other FQDN validation has been suppressed by setting
gtm globlal-settings general domain name check == 'none'.

---

569472-2 : TMM segfault in lb_why_pmbr_str after GTM/BIG-IP DNS disables a GTM pool and LB why log is enabled

Component: Global Traffic Manager

Symptoms:
tmm cores with sigsegv within lb_why_pmbr_str.

Conditions:
1. Disable a GTM/BIG-IP DNS pool or pool member;
2. pool-member-selection is enabled for load-balancing-decision-log-verbosity.

Impact:
tmm cores.

Workaround:
Disable pool-member-selection for load-balancing-decision-log-verbosity.

Fix:
tmm no longer cores when disabling pool-member-selection for load-balancing-decision-log-verbosity.

---

569467-11 : BIG-IP and BIG-IQ cloud image vulnerability CVE-2016-2084.

Solution Article: K11772107

---

569356-2 : BGP ECMP learned routes may use incorrect VLAN for nexthop

Solution Article: K91428939

Component: TMOS

Symptoms:
Border Gateway Protocol (BGP) with Equal Cost Multipath (ECMP) may result in learned routes that use an incorrect nexthop Virtual Local Area Network (VLAN).

As a result of this issue, you may encounter one or more of the following symptoms:

The system may randomly send the traffic using the incorrect nexthop.

Conditions:
-- BIG-IP configuration with two or more VLANs configured with IPv6 global addresses.
-- BGP with ECMP is peered with an active IPv6 BGP neighbor. -- BGP is configured with max-paths.

Impact:
The traffic randomly gets sent using the incorrect nexthop.

Workaround:
None.

Fix:
Routes learned from the peer now have the correct nexthop VLANs.

---

569355-3 : Java vulnerabilities CVE-2015-4871 CVE-2015-7575 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494

Solution Article: K50118123

---

569349-2 : Packet's vlan priority is not preserved for CMP redirected flows when net cos feature is enabled

Component: Local Traffic Manager

Symptoms:
When net cos (class of Service) feature is enabled, vlan priority for those cmp redirected packets are not being preserved from ingress to egress.

Conditions:
1. net cos feature is enabled
2. packet is being cmp redirected from one tmm to another tmm for processing.

Impact:
Egress packets are not being processed according to the ingress vlan priority by BIG-IP and down stream router. Certain packets will be dropped by downstream router due to the wrong mark of vlan priority.

Workaround:
None.

---

569337-2 : TCP events are logged twice in a HA setup

Component: Advanced Firewall Manager

Symptoms:
TCP log events are logged twice (if enabled in security log profile) with connection mirroring enabled on the virtual server in a HA setup (Active/Standby).

Conditions:
When there's a HA setup (Active/Standby) or both client side and server side connection flow.

Impact:
TCP log events are logged twice (duplicate events from active unit and standby unit or from both client side and server side of the connection flow).

Workaround:
N/A

Fix:
TCP log events are no longer logged twice when enabled in the security log profile with connection mirroring enabled on the virtual server in a HA setup (Active/Standby).

---

569309-1 : Clientside HTML parser does not recognize HTML event attributes without value

Component: Access Policy Manager

Symptoms:
Assignment of a specific HTML content to tag.innerHTML could lead to a JavaScript error. This happens when one or more of tags in HTML text contain html event attributes without value (such as <div onclick />)

Following or similar error is logged in browser JavaScript console:
Unable to get property 'charAt' of undefined or null reference

Impact:
Web application does not work when accessed through Portal Access.

Workaround:
iRule could be provided for specific application.

Fix:
Now empty inline event handler attributes are not rewritten on client side.

---

569306-3 : Edge client does not use logon credentials even when "Reuse Windows Logon Credentials" is selected

Component: Access Policy Manager

Symptoms:
User is shown the logon page to connect to VPN after he logs on. Windows logon credentials are not used for VPN automatically.

Conditions:
Connectivity profile has "Reuse Windows Logon Credentials" selected

Impact:
User has to retype his credentials to connect to VPN

Workaround:
Enter the credentials again to connect to VPN

Fix:
Now logged on credentials are used automatically to connect to VPN

---

569288-2 : Different LACP key may be used in different blades in a chassis system causing trunking failures

Component: Local Traffic Manager

Symptoms:
In rare conditions, different blades in a chassis system may use different LACP keys for the same trunk in the LACP control frames. This will cause some of the LACP trunk members not able to aggregate successfully with peer switch.

Conditions:
This only happens in a chassis based system when certain race condition causes trunk id being modified after initial trunk creation.

Impact:
Non aggregated trunk members won't be able to pass traffic.

Workaround:
Restart lacpd in all the blades in the chassis by running command "clsh bigstart restart lacpd"

---

569255-3 : Network Access incorrectly manipulates routing table when second adapter being connected if "Allow Local subnet access' is set to ON

Solution Article: K81130213

Component: Access Policy Manager

Symptoms:
When Network Access is already established and a second network interface is being connected to client system, VPN quickly reconnects, which breaks existing TCP connections. Because reconnect occurs very quickly, it might appear to the user that nothing happened.

Conditions:
-- 'Allow Local subnet access' enabled.
-- Client system is getting second network interface connected.

Impact:
Long-standing TCP connection may break, for example, VPN over Network Access.

Workaround:
Disable 'Allow Local subnet access'.

Fix:
Now Network Access remains stable when a second network interface is being connected, so any long-standing TCP connections (such as VPN over Network Access) continue as expected.

---

569236-4 : BIG-IP logs INVALID-SPI messages but does not remove the associated SAs.

Component: TMOS

Symptoms:
The BIG-IP system logs INVALID-SPI messages but does not remove the associated Security Associations (SAs) corresponding to the message. This is the first part of a fix provided for this issue. See fixes for bug 569236 for the second part.

Conditions:
This can occur if an IPsec peer deletes a phase2 (IPsec) SA and does not send a 'notify delete' message to the other peer. The INVALID-SPI message is most likely to be seen when the peer deletes an SA before the SA's agreed lifetime.

Impact:
If the BIG-IP is always the Initator, the Responder will not initiate a new tunnel if the Responder only handles responses to the BIG-IP clients' traffic. The BIG-IP system continues to use the IPsec SA it believes to be still up. When an SA expires prematurely, some IPsec peers will reject an inbound SPI packet with an ISAKMP INVALID-SPI notify message. If the INVALID-SPI message does not cause new SAs to be created, there will be a tunnel outage until the SA lifetime expires on the defunct SA held on the BIG-IP system.

Workaround:
Manually remove the invalid SA on the BIG-IP system.

Fix:
Now, when the BIG-IP system receives INVALID-SPI messages, it deletes the invalid Security Association as well as logging the INVALID-SPI message, so the tunnel can initiate again. This is part one of a two-part fix. Fixes for bug 583285 provide part two of the fix.

---

569206-2 : After connectivity loss and restoration between HSM and pkcs11d, SSL fails on some blades.

Solution Article: K47952434

Component: Local Traffic Manager

Symptoms:
After connectivity loss and restoration between HSM and pkcs11d, SSL fails on some blades.

Conditions:
Connectivity loss and restoration between HSM and pkcs11d.

Impact:
Sometimes, one or more blades have SSL failure consistently. Others are working fine after the network restoring.

Workaround:
None. This is an intermittent failure.

Fix:
All blades now recover the working condition after the network is restored.

---

568889-2 : Some ZebOS daemons do not start on blade transition secondary to primary.

Solution Article: K22989000

Component: TMOS

Symptoms:
In some specific cases the standby unit's secondary blade ZebOS daemons might not get started when it becomes active.

Conditions:
If the failover occurs as a result of the primary blade's mcpd restarting

Impact:
The new primary blade does not start some ZebOS daemons resulting in ospf not working as expected on the standby unit.

Workaround:
Run the following tmsh command on the new active unit: bigstart restart tmrouted.

Fix:
The BIG_IP system now correctly starts ZebOS daemons on the standby unit on a new blade that is starting up as a primary.

---

568743-3 : TMM core when dnssec queries to dns-express zone exceed nethsm capacity

Component: Local Traffic Manager

Symptoms:
tmm crashes, and in /var/log/ltm you see entries indicating "Signature failed":

err tmm1[16816]: 01010216:3: DNSSEC: Signature failed (signature creation) for RRSET (host0530.f5test.net, 1) with key /Common/myZSK2, generation 1.

Conditions:
This can occur when a dns-express zone generates more responses than the Thales can sign. The excess requests are queued and tmm can core.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
TMM no longer core when dnssec queries to dns-express zone exceed nethsm capacity.

---

568670-2 : ASM fails to start with error - ndefined subroutine &F5::CRC::get_crc32

Component: Application Security Manager

Symptoms:
ASM fails to start with error in ts_debug.log -

Undefined subroutine &F5::CRC::get_crc32 called at /usr/local/share/perl5/F5/RamCache.pm line 69

Conditions:
asm provisioned

Impact:
asm fails to start

Workaround:
n/a

Fix:
A rare condition in which asm fails to start has been fixed

---

568543-3 : Syncookie mode is activated on wildcard virtuals

Component: Local Traffic Manager

Symptoms:
Syncookie mode can be activated with a wildcard virtual, even in the case where there is no SYN flood.

Conditions:
The default number of connections per second before activating syncookie mode is 1993. This value can be increased to a max of 4093. After this threshold is reached, then syncookie mode is activated. This is an insufficient maximum for wildcard virtuals, since they can have 30k+ connections per second.

Impact:
Syncookie mode is activated with high connection rates to a wildcard virtual.

Workaround:
Break up the wildcard virtual into multiple virtuals to reduce the number of connections per virtual.

Fix:
It is now possible to set the PvaSynCookies.Virtual.MaxSynCache DB variable to 64K (previous max was 4093)

---

568347-2 : BD Memory corruption

Component: Application Security Manager

Symptoms:
An Enforcer crash occurs and UMU errors may appear in the bd.log file.

Conditions:
N/A

Impact:
Traffic goes down while the Enforcer goes back up.

Fix:
Fixed a memory corruption issue.

---

567862-1 : intermittent SSL traffic failure with Safenet HSM on BIG-IP chassis and appliance

Component: Local Traffic Manager

Symptoms:
BIG-IP intermittently has SSL traffic failures with HSM. This symptom happens on both chassis and appliance. The general error messages are logged with

"FIPS acceleration device failure: fips_poll_completed_reqs: req: 44 status: 0x1 : Cancel"

Conditions:
When Safenet HSM is used with BIG-IP.

Impact:
SSL traffic is failing.

Workaround:
"bigstart restart pkcs11d" might mitigate this issue.

Fix:
Multiple issues are fixed including better sync-up between tmm and pkcs11d. Fixes are also included to deal with key handle changes at HSM.

---

567774-1 : ca-devices and non-ca-devices addition/deletion has been removed from restart cm trust-domain Root

Component: TMOS

Symptoms:
The properties 'ca-devices' and 'non-ca-device' are available in the 'restart' command but are not valid.

Conditions:
None

Impact:
You should not use the restart command with the properties 'ca-devices' and 'non-ca-device'. It has to be used similar to the delete command.

Workaround:
A new tmsh command to reset a device trust was added:
'restart cm trust-domain Root' which operates exactly like 'delete cm trust-domain Root'. The properties 'ca-devices' and 'non-ca-device' are available in the 'restart' command but are not valid. These properties are not available in the 'delete cm trust-domain'. Workaround for customer is to not use these two properties when running the 'restart cm trust-domain' command or to use the 'delete cm trust-domain'

Fix:
The 'ca-devices' and 'non-ca-devices' properties were removed from the tmsh command 'restart cm trust-domain' command because they are not valid.

---

567660-2 : Disabling global Auto Last Hop setting breaks APM's Remote Desktop Gateway (RDG) feature

Component: Access Policy Manager

Symptoms:
Existing TCP connection is being sporadically disrupted by BIGIP virtual server sending out a SYN, ACK, causing existing connection to fail.
The client and virtual server setup a good tcp connection, complete SSL handshake and starts to pass application data.
APM virtual then sends SYN, ACK with sequence and ack numbers which do not match existing stream.
The APM then tries three syn-ack's before giving up and sends out a rst-ack which drops the connection attempt, but as it shares the same ip:port number as the existing connection, resets the good connection.

Conditions:
Auto Last Hop setting is disabled

Impact:
APM RDG feature does not work

Workaround:
1. Enable Auto Last Hop
OR
2. Set cmp_enabled to 'NO' on virtual

Fix:
APM RDG feature now works as expected when Auto Last Hop is disabled.

---

567503-5 : ACCESS::remove can result in confusing ERR_NOT_FOUND logs

Solution Article: K03293396

Component: Access Policy Manager

Symptoms:
When using the iRule command ACCESS::remove, ERR_NOT_FOUND messages may appear in /var/log/apm. Theses are not real errors. ACCESS is trying to insert a session variable, but it is not able to find the session because the iRule already deleted the session.

The logs in /var/log/apm look something like this:
err tmm1[15932]: 01490514:3: 00000000: Access encountered error: ERR_NOT_FOUND. File: ../modules/hudfilter/access/access.c, Function: access_save_init_req_to_sessiondb, Line: 14823.

Conditions:
An iRule using the command ACCESS::remove, and the end-user does a POST.

Impact:
No functional impact, the iRule correctly deletes the session, and BIG-IP does not send a reset. But the log messages can be alarming or confusing.

Workaround:
None.

Fix:
ACCESS::remove no longer results in confusing ERR_NOT_FOUND logs.

---

567484-5 : BIND Vulnerability CVE-2015-8705

Solution Article: K86533083

---

567475-5 : BIND vulnerability CVE-2015-8704

Solution Article: K53445000

---

567457-3 : TMM may crash when changing the IKE peer config.

Component: TMOS

Symptoms:
TMM might crash when changing the IKE peer config. It can happen with either IKEv1 or IKEv2 (TMM config crash).

Conditions:
This occurs when making changes to IPsec tunnels that causes the configuration to become invalid. For example, changing ISAKMP phase1 from SHA-1 to MD5 results in an invalid configuration.

Note: This occurs in the GUI only. The tmsh 'create' command does not cause this core.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
You can use tmsh to make the affected configuration changes... this occurs in the GUI only. The tmsh 'create' command does not cause this core.

Fix:
TMM no longer crashes when changing the IKEv1 or IKEv2 peer config, even if the changes are not valid for the configuration.

---

567379-1 : libtar vulnerability CVE-2013-4397

Solution Article: K16015326

---

567355-1 : Scheduled report lost after loading configuration

Component: Application Visibility and Reporting

Symptoms:
Saved scheduled report will be lost after loading the system configuration.

Conditions:
Create scheduled report.
Save the configuration.
Load the configuration.
The scheduled report wont be existing anymore.

Impact:
The scheduled report can be lost.

Fix:
A saved scheduled report is no longer lost after loading the system configuration.

---

566998-2 : Edge client upgrade fails if client was configured in locked mode★

Component: Access Policy Manager

Symptoms:
Edge client cannot be upgraded automatically to a newer version

Conditions:
Edge client package was downloaded with "Enable Always Connected mode" option checked

Server contains a newer version of edge client

Impact:
Automatic upgrade of edge client will fail

Workaround:
Manually uninstall and re-install client

---

566908-5 : Webserver listening on local Wifi or ethernet IP cannot be accessed after VPN with proxy.pac file

Solution Article: K54435973

Component: Access Policy Manager

Symptoms:
Webserver listening on local Wifi or ethernet IP cannot be accessed after VPN if proxy.pac is defined in a way that forwards all web traffic over VPN.

Conditions:
proxy.pac, network access, OS X system.

Impact:
Local web server is inaccessible if proxy.pac is defined in a way that forwards all traffic over VPN to corporate proxy server.

Workaround:
None.

Fix:
Webserver listening on local Wifi or Ethernet IP can be accessed after VPN even if proxy.pac is defined in a way that forwards all web traffic over VPN to corporate proxy server.

---

566758-2 : Manual changes to policy imported as XML may introduce corruption for Login Pages

Component: Application Security Manager

Symptoms:
Manual changes to policy imported as XML may introduce corruption for Login Pages. If the expiration period is omitted, the Login Page will be inaccessible.

Conditions:
Expiration period is omitted in hand-crafted XML policy file.

Impact:
The Login Page created as a result is inaccessible in GUI and REST.

Workaround:
Ensure that expiration period exists in XML policy file before import.

Fix:
A policy file, with a missing expiration field, imported as XML is now handled correctly.

---

566646-4 : Portal Access could respond very slowly for large text files when using IE < 11

Component: Access Policy Manager

Symptoms:
When accessing a large 'text/plain' file from server with Internet Explorer versions 7 through 10 client browsers, Portal Access sometimes holds the response until it fetches and processes the entire file contents. This can take several dozen seconds, or even minutes.

Conditions:
Internet Explorer version 7 through 10 with Portal Access

Impact:
Large text files can't be accessed or downloaded through Portal Access.

Workaround:
Irule that does any of following:
a) Preferred: append F5CH=I to request uri in HTTP_REQUEST for affected requests.
b) Call REWRITE::disable for affected requests.

Fix:
Fixed the issue where Portal Access could try to buffer contents of some large files and respond with significant delay.

---

566576-2 : ICAP/OneConnect reuses connection while previous response is in progress

Component: Service Provider

Symptoms:
ICAP with OneConnect sometimes initiates a new ICAP request (REQMOD or RESPMOD) on the server connection while a previous response on the same connection is still being streamed from the ICAP server. This can cause the server to append the new response after the end of the previous response, in the same packet.

Conditions:
There is a 'oneconnect' profile on the internal virtual server along with the 'icap' profile.
Triggered by a disconnection of the IVS by the parent HTTP virtual server, before the ICAP transaction is complete.
This can happen for a number of reasons, such as an error in detected on the HTTP virtual server, or an HTTP::respond iRule that replaces an IVS response in progress.

Impact:
The connection used by the interrupted transaction is returned to the pool for reuse, potentially resulting in a new ICAP transaction beginning before the end of the interrupted one, and its response may be concatenated to the incomplete tail of the first one. OneConnect is unable to separate the contiguous ICAP responses whose boundary is within a packet. All the packet payload goes to the first ICAP transaction, and any payload after the terminating chunk is discarded. Thus the beginning of the second response is lost and its header parser gets confused. It keeps waiting for more data and rescanning the entire response, resulting in increasing CPU use up to 100% until the connection is aborted.

Workaround:
Remove OneConnect.

Fix:
Big-IP with ICAP and OneConnect never reuses a server connection while a previous ICAP transaction is still in progress. Whenever the IVS disconnects prior to completion of an ICAP transaction, the connection is not pooled for reuse.

---

566507-2 : Wrong advertised next-hop in BGP for a traffic group in Active-Active deployment

Component: TMOS

Symptoms:
The advertised next-hop is a floating-IP of the active traffic-group on a peer BIG-IP system, although it should be the floating-IP of the traffic-group active on the current BIG-IP system.

Conditions:
-- In a BIG-IP high availability (HA) configuration.
-- The HA configuration is Active-Active topology.
-- There are multiple traffic-groups, in which each device is active for one traffic-group.

Impact:
An incorrect next-hop in BGP is advertised for a traffic group in Active-Active deployment. Traffic for relevant advertised routes might go to a standby device.

Workaround:
Configure the floating address of a traffic group as the next-hop in its route-map.

Fix:
The advertised next-hop in BGP is now the smallest floating-IP active on the current BIG-IP system. Note: The ZebOS routing protocol suite available for BIG-IP configurations does not support traffic groups, so this issue might still be seen in certain circumstances.

---

566361-8 : RAM Cache Key Collision

Solution Article: K11543589

Component: Local Traffic Manager

Symptoms:
Intermittent tmm SIGSEGV when RAM Cache is enabled

Conditions:
This occurs when RAM cache is enabled in certain circumstances.

Impact:
Invalid response format, and/or serving the wrong object from cache, and/or tmm crash, interruption of service.

Workaround:
None.

Fix:
The system now avoids RAM Cache Key collisions, the correct object and response format are delivered from the cache, and tmm no longer cores.

---

566071-1 : network-HSM may not be operational on secondary slots of a standby chassis.

Component: Local Traffic Manager

Symptoms:
pkcs11d may not be running on secondary slots of a chassis.

Conditions:
This might occur when the following conditions are true:
1. Network-HSM installed on BIG-IP chassis.
2. Chassis is in standby state OR Secondary slots do not have management IP configured.

Impact:
If SSL profiles are configured with keys of security-type 'nethsm' when the specified conditions are true, traffic for such profiles will fail when the affected slots process traffic.

Workaround:
Manually install netHSM on each secondary slot.

Fix:
netHSM install no longer depends on management IP of secondary slots and also successfully installs on slots of a standby chassis.

---

566061-3 : Subscriber info missing in flow report after subscriber has been deleted

Component: Policy Enforcement Manager

Symptoms:
If we have a subscriber flow during which the subscriber gets deleted, then the flow reports begin to report subscriber id as "unknown". It becomes difficult to map the flow to that specific subscriber.

Conditions:
Flow reporting is enabled for a subscriber. And the subscriber gets deleted in the middle of a flow.

Impact:
If the customer is looking for subscriber id to match the flows, then they would miss out on these flows that get reported with unknown subscriber.

Fix:
We now save the subscriber id so that it can be accessed even after the subscriber has been deleted.

---

565895-4 : Multiple PCRE Vulnerabilities

Solution Article: K17235

---

565810-2 : OneConnect profile with an idle or strict limit-type might lead to tmm core.

Solution Article: K93065637

Component: Local Traffic Manager

Symptoms:
OneConnect profile with an idle or strict limit-type might lead to tmm core.

Conditions:
OneConnect profile with a limit-type value of idle or strict.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Use a limit-type of 'none'.

Fix:
A OneConnect profile using an idle or strict limit-type no longer causes the tmm to core when attempting to shutdown idle connections.

---

565799-2 : CPU Usage increases when using masquerade addresses

Component: Local Traffic Manager

Symptoms:
When using masquerade addresses, CPU usage increases. This can ultimately lead to a reduction in device capacity.

Conditions:
This can occur if one or more of your traffic groups is configured to use a MAC Masquerade address.

Impact:
Possible performance degradation or reduction in capacity

Fix:
Performance of masquerade address checks is restored.

---

565765-3 : Flow reporting does not occur for unclassified flows.

Component: Policy Enforcement Manager

Symptoms:
Flow reports are missing for some of the flows.

Conditions:
Flow reporting action has been configured with no classification filter. This was observed for flows that remained unclassified until the very end.

Impact:
If you are using flow reports to track the data usage of the subscriber, the usage will not be accurate.

Workaround:
None.

Fix:
For flows that do not get classified at all, the system now sends out flow reports at the end of the flow. The FLOW_INIT and FLOW_END reports are sent out in this case (that is, there are no FLOW_INTERIM reports). This is correct behavior

---

565534-2 : Some failover configuration items may fail to take effect

Solution Article: K40254066

Component: TMOS

Symptoms:
These symptoms apply to version 12.0.0 and later:

When only multicast failover is configured, traffic-groups are active on all devices in the device-group. If unicast failover is also configured, the traffic-group unexpectedly switches to a different device.

These symptoms can occur on all versions:

When the unicast address list is changed at the same time as other device properties, sod (the failover daemon) may fail to recognize one of the other changes.

Conditions:
For version 12.0.0 and later:

Multicast failover is configured and the system loads the configuration from the configuration files. For example during the first boot of a new boot location, or after performing the procedure in K13030: Forcing the mcpd process to reload the BIG-IP configuration https://support.f5.com/csp/article/K13030.

For all versions:

A change is made to the cm device configuration that includes a unicast-address change along with something else.

Impact:
When only multicast failover is configured, traffic-groups may become active on all devices in the device-group. If unicast failover is also configured, the traffic-group might switch to a different device.

Workaround:
Mitigation for v12.0.0 (and later) symptom:

To restore multicast failover, disable and re-enable multicast failover.

To do so, perform the following procedure on the the local device.
1. Determine which interface is being used for multicast failover by running the follo