Unscored severity · published Jul 27, 2005
CVE-2005-2384
Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460,…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460, allows remote attackers to write arbitrary files via an ACE archive containing filenames with (1) .. or (2) absolute pathnames.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Avast Antivirus · Alwil
4.6.460; 4.6.665; 4.6.665 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2384
Patch
http://secunia.com/advisories/15776
Patch
http://secunia.com/secunia_research/2005-20/advisory/
securitytracker.com
http://securitytracker.com/id?1014544
www.avast.com
http://www.avast.com/eng/av4_revision_history.html
More from Avast Antivirus
–
CVE-2012-1459
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus…
–
CVE-2012-1457
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal…
–
CVE-2012-1443
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint…
–
CVE-2007-0829
avast! Server Edition before 4.7.726 does not demand a password in a certain intended context, even when a password has been set, which allows local users to bypass authentication…
–
CVE-2006-4626
Heap-based buffer overflow in alwil avast! Anti-virus Engine before 4.7.869 allows remote attackers to execute arbitrary code via a crafted LHA file that contains extended headers…