High severity · published Sep 18, 2023
CVE-2023-42525
Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Atlant · Withsecure
1.0.35-1 · source: NVD
CS
Client Security · Withsecure
15; 15 · source: NVD
EE
Elements Endpoint Protection · Withsecure
17 and later; 17 and later · source: NVD
EA
Email And Server Security · Withsecure
15 · source: NVD
LP
Linux Protection · Withsecure
12.0 · source: NVD
LS
Linux Security 64 · Withsecure
12.0 · source: NVD
SS
Server Security · Withsecure
15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-42525
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-42525
Vendor Advisory
https://www.withsecure.com/en/support/security-advisories
More from Atlant
7.5
CVE-2023-47264
Certain WithSecure products have a buffer over-read whereby processing certain fuzz file types may cause a denial of service (DoS)
7.5
CVE-2023-47263
Certain WithSecure products allow a Denial of Service (DoS) in the antivirus engine when scanning a fuzzed PE32 file
7.5
CVE-2023-42524
Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types
7.5
CVE-2023-42523
Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file
7.5
CVE-2023-42522
Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file