Vulnerability in Alwil Avast Antivirus

CVE-2005-2384

Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460, allows remote attackers to write arbitrary files via an ACE archive containing filenames with (1) .. or (2) absolute pathnames.

EPSS: 0.035 (88.5th percentile) — read the EPSS interpretation.

Affected products

Alwil Avast_antivirus — versions 4.6.460, 4.6.665
N/a — versions n/a

References

cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC)
cve@mitre.org (vdb-entry, x_refsource_SECTRACK)