OpenSSL and Heart Bleed Vuln

There is no update. v11.5 is vulnerable to this issue in two respects: 1) Where the Management Web GUI is concerned and 2) If any of your SSL Profiles contain cipher strings which contain compat ciphers but only if the client negotiates a compat cipher (which a hacker clearly would ensure happens).

oke waiting for a update then, had an upgrade scheduled for 11.5, but actually our 10.2.4 version is actually safer then :D

I'm not a security expert, so you may want to verify this independently: 1. The Native Stack on the Bigip v11.5.0 is not vulnerable. 2. You can force use of the native stack by specifying "NATIVE" as your cipher suites list on your SSL profiles. On 11.5, there is a long list of ciphers supported by NATIVE, so this should not cause any significant loss of options for connecting clients.

That said, I wouldn't update my production boxes to 11.5 just yet, unless there is a pressing need for a feature there. Usually good to give software a few months for other brave souls to test before you upgrade your critical devices.