F-secure vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-7240 F-Secure Total Link Following Local Privilege Escalation Vulnerability.High 7.8 · Nov 22, 2024
• CVE-2023-49322 Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash.High 7.5 · Nov 26, 2023
• CVE-2023-43767 Certain WithSecure products allow Denial of Service via the aepack archive unpack handler.High 7.5 · Sep 22, 2023
• CVE-2023-43766 Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler.High 7.8 · Sep 22, 2023
• CVE-2023-43765 Certain WithSecure products allow Denial of Service in the aeelf component.High 7.5 · Sep 22, 2023
• CVE-2023-43761 Certain WithSecure products allow Denial of Service (infinite loop).High 7.5 · Sep 22, 2023
• CVE-2023-43760 Certain WithSecure products allow Denial of Service via a fuzzed PE32 file.High 7.5 · Sep 22, 2023
• CVE-2022-38166 In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler crashes.High 7.5 · Nov 25, 2022
• CVE-2021-33601 A vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper.High 7.6 · Sep 28, 2021
• CVE-2020-14978 An issue was discovered in F-Secure SAFE 17.7 on macOS.High 8.1 · Jun 23, 2020
• CVE-2020-14977 An issue was discovered in F-Secure SAFE 17.7 on macOS.High 8.1 · Jun 23, 2020
• CVE-2019-11644 In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client SecHigh 7.8 · May 17, 2019
• CVE-2018-10403 An issue was discovered in F-Secure XFENCE and Little Flocker.High 7.8 · Jun 13, 2018
• CVE-2015-8264 Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan High 7.8 · Aug 2, 2017
• CVE-2017-6466 F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrityHigh 8.1 · Mar 11, 2017
• CVE-2013-7369 SQL injection vulnerability in an unspecified DLL in the FSDBCom ActiveX control in F-Secure Anti-Virus for Microsoft Exchange Server before HF02, Anti-Virus foHigh 7.5 · Apr 18, 2014
• CVE-2008-6085 Integer overflow in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, when configuHigh 7.6 · Feb 6, 2009
• CVE-2008-0910 Multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, F-Secure Protection Service, and others, allHigh 7.5 · Feb 22, 2008
• CVE-2007-3300 Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070619 allow remote attackers to bypass scanning via a crafted header in a (1) LHHigh 9.3 · Jun 20, 2007
• CVE-2007-2965 Unspecified vulnerability in the Real-time Scanning component in multiple F-Secure products, including Internet Security 2005, 2006 and 2007; Anti-Virus 2005, 2High 7.2 · May 31, 2007
• CVE-2007-2966 Buffer overflow in the LHA decompression component in F-Secure anti-virus products for Microsoft Windows and Linux before 20070529 allows remote attackers to exHigh 7.5 · May 31, 2007
• CVE-2007-2967 Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070522 allow remote attackers to cause a denial of service (file scanning infinitHigh 10 · May 31, 2007
• CVE-2007-1557 Format string vulnerability in F-Secure Anti-Virus Client Security 6.02 allows local users to cause a denial of service and possibly gain privileges via format High 7.2 · Mar 20, 2007
• CVE-2006-6409 F-Secure Anti-Virus for Linux Gateways 4.65 allows remote attackers to cause a denial of service (possibly fatal scan error), and possibly bypass virus detectioHigh 10 · Dec 9, 2006
• CVE-2006-2838 Buffer overflow in the web console in F-Secure Anti-Virus for Microsoft Exchange 6.40, and Internet Gatekeeper 6.40 through 6.42 and 6.50 allows remote attackerHigh 7.6 · Jun 6, 2006