CVE-2008-6085: F-Secure Anti-Virus

High severity, CVSS 7.6. EPSS: 5.5% chance of exploitation in the next 30 days.

Integer overflow in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2008, and others, when configured to scan inside compressed archives, allows remote attackers to execute arbitrary code via a crafted RPM compressed archive file, which triggers a buffer overflow.

Affected products

  • F-Secure F-Secure Anti-Virus: version 7.02 only; version 2006 only; version 2007 only; version 2008 only; version 2009 only
  • F-Secure F-Secure Anti-Virus For Citrix Servers: up to and including 7.00
  • F-Secure F-Secure Anti-Virus For Microsoft Exchange: up to and including 7.10; version 6.62 only; version 7.00 only
  • F-Secure F-Secure Anti-Virus For Mimesweeper: up to and including 5.61
  • F-Secure F-Secure Anti-Virus For Windows Servers: up to and including 8.00
  • F-Secure F-Secure Anti-Virus For Workstations: version 7.10 only; version 7.11 only
  • F-Secure F-Secure Anti-Virus Linux Client Security: up to and including 5.54; version 5.30 only; version 5.52 only; version 5.53 only
  • F-Secure F-Secure Anti-Virus Linux Server Security: up to and including 5.54; version 5.30 only; version 5.52 only
  • F-Secure F-Secure Client Security: up to and including 7.12; version 7.11 only
  • F-Secure F-Secure Home Server Security: version 2009 only
  • F-Secure F-Secure Internet Gatekeeper For Linux: up to and including 2.16
  • F-Secure F-Secure Internet Gatekeeper For Windows: up to and including 6.61
  • F-Secure F-Secure Internet Security: version 7.02 only; version 2006 only; version 2007 only; version 2008 only; version 2009 only
  • F-Secure F-Secure Linux Security: up to and including 7.01
  • F-Secure F-Secure Messaging Security Gateway: up to and including 5.0.4; version 4.0.7 only
  • F-Secure F-Secure Protection Service For Business: up to and including 3.10; version 3.00 only
  • F-Secure F-Secure Protection Service For Consumers: up to and including 8.00; version 5.00 only; version 6.00 only; version 7.00 only

Published 2009-02-06. Last modified 2026-06-16.