Security advisory

A denial-of-service (DoS) vulnerability in WithSecure component may crash the scanning engine. 

A critical vulnerability in the Spring framework affects the following products: F-Secure Policy Manager, F-Secure Policy Manager for Linux, F-Secure Policy Manager Proxy, and F-Secure Elements Connector.

WithSecure Support Tool (fsdiag) embedded within various WithSecure products for Microsoft Windows can be abused to execute arbitrary commands on the system.

Vulnerabilities in the browser protection of WithSecure SAFE for Android could allow remote attacker to steal user's sessions cookie.

Vulnerabilities in the browser of WithSecure SAFE for Android could allow execution of JavaScript. 

Crash while scanning fuzzed files can cause denial-of-service of the antivirus engine.

All F-Secure endpoint protection products, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper & F-Secure Security Cloud

CVE-2021-40837

All F-Secure endpoint protection products, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper

CVE-2021-40836

F-Secure SAFE Browser Version 18.3.x and below

CVE-2021-40835

F-Secure SAFE Browser Version 18.3.x and below

CVE-2021-40834

All F-Secure endpoint protection products, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, and F-Secure Internet Gatekeeper

CVE-2021-40833

All F-Secure endpoint protection products, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper, F-Secure Cloud Protection for Salesforce, and F-Secure Elements for Microsoft 365

CVE-2021-40832

All F-Secure endpoint protection products, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper, F-Secure Cloud Protection for Salesforce, and F-Secure Elements for Microsoft 365

CVE-2021-33603

All F-Secure endpoint protection products, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, F-Secure Internet Gatekeeper, and F-Secure Cloud Protection for Salesforce

CVE-2021-33602

F-Secure Internet Gatekeeper 5 Series

CVE-2021-33601

F-Secure Internet Gatekeeper 5 Series

CVE-2021-33600

All F-Secure endpoint protection products, F-Secure Linux Security (32-bit), F-Secure Linux Security 64, F-Secure Atlant, and F-Secure Cloud Protection for Salesforce

CVE-2021-33599

All F-Secure endpoint protection products and F-Secure Linux Security

CVE-2021-33598

F-Secure SAFE Browser for iOS

CVE-2021-33596

F-Secure SAFE Browser for iOS

CVE-2021-33595

F-Secure SAFE Browser for Android

CVE-2021-33594

All F-Secure endpoint protection products and F-Secure Security Cloud

CVE-2021-33597

All F-Secure endpoint protection products, F-Secure Security Cloud, F-Secure Elements for Microsoft 365, and F-Secure Cloud Protection for Salesforce

CVE-2021-33572

F-Secure Cloud Protection for Salesforce

Multiple buffer overflow vulnerabilities can lead local privilege escalation.

A local user can rename or delete arbitrary files owned by root in Linux Security.

Vulnerability in web user interface of the F-Secure Linux Security can lead to remotely disable product settings.