CVE Vulnerabilities

CVE-2022-28875

Improper Resource Shutdown or Release

Published: May 25, 2022 | Modified: Jun 08, 2022
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can crash the scanning engine. The exploit can be triggered remotely by an attacker.

Weakness

The product does not release or incorrectly releases a resource before it is made available for re-use.

Affected Software

Name Vendor Start Version End Version
Atlant F-secure - (including) - (including)
Cloud_protection_for_salesforce F-secure - (including) - (including)
Elements_collaboration_protection F-secure - (including) - (including)
Internet_gatekeeper F-secure - (including) - (including)
Linux_security F-secure - (including) - (including)

Potential Mitigations

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.

References