Vulnerability · Published Aug 10, 2022 · Assigned by F-SecureUS

CVE-2022-28881Denial-of-Service (DoS) Vulnerability

Medium 4.3

In plain English

A medium-severity security flaw in All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-Secure Internet Gatekeeper WithSecure Clo from F-Secure and WithSecure. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function crashes which leads to scanning engine crash. The exploit can be triggered remotely by an attacker.

Affected products (as reported)

Vendor	Product	Versions
F-Secure and WithSecure	All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-Secure Internet Gatekeeper WithSecure Cloud Protection for Salesforce WithSecure Collaboration Protection	All Version

References

https://www.f-secure.com/en/business/support-and-downloads/security-advisories x_refsource_MISC
https://www.withsecure.com/en/support/security-advisories x_refsource_MISC