CVE-2005-2384

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-07-27 · updated 2026-06-16

Description

Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460, allows remote attackers to write arbitrary files via an ACE archive containing filenames with (1) .. or (2) absolute pathnames.

Affected products

Alwil Avast Antivirus: 4.6.460, 4.6.665

References

http://secunia.com/advisories/15776
http://secunia.com/secunia_research/2005-20/advisory/
http://securitytracker.com/id?1014544
http://www.avast.com/eng/av4_revision_history.html
http://secunia.com/advisories/15776
http://secunia.com/secunia_research/2005-20/advisory/
http://securitytracker.com/id?1014544
http://www.avast.com/eng/av4_revision_history.html

Get alerted when CVE-2005-2384 or the next vulnerability affects your stack