Vulnerability · Published May 23, 2022 · Assigned by F-SecureUS

CVE-2022-28874Multiple Denial-of-Service (DoS) Vulnerabilities

Medium 4.3

In plain English

A medium-severity security flaw in F-Secure endpoint protection products for Windows and Mac. F-Secure Linux Security (32-bit). F-Secure Linux Security 64. F-Secure Atlant. WithSecure Cloud Protection for Salesforce & WithSecure Coll from F-Secure. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 50.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files cause memory corruption and heap buffer overflow which eventually can crash the scanning engine. The exploit can be triggered remotely by an attacker.

Affected products (as reported)

Vendor	Product	Versions
F-Secure	F-Secure endpoint protection products for Windows and Mac. F-Secure Linux Security (32-bit). F-Secure Linux Security 64. F-Secure Atlant. WithSecure Cloud Protection for Salesforce & WithSecure Collaboration Protection	All Version

References

https://www.f-secure.com/en/home/support/security-advisories x_refsource_MISC
https://www.withsecure.com/en/support/security-advisories x_refsource_MISC