Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2004-1094: Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to

59
This week
HIGH 10.0UPGRADEUPGRADEDOWNGRADE

CVE-2004-1094 is a high-severity flaw (CVSS 10.0) affecting checkmark payroll, multiledger, dynazip library. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053), RealOne Player 1 and 2, (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier, (3) CheckMark MultiLedger before 7.0.2, (4) d

Why this priority

  • Critical severity
  • EPSS top 5%: very likely to be exploited

A fixed release or distro patch exists.

Risk facts

CVSS score10.0 (High)
EPSS exploit chance9.6% (top 5%)
CISA exploited listNo
Published2005-01-10
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: checkmark · innermedia · realnetworks

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

checkmark checkmark payroll UPGRADE
Affected: <= 3.9.6 · 3.7.5 · 3.9.1 · 3.9.2 · 3.9.3 · 3.9.4 · 3.9.5
Fixed in: newer than 3.9.6
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy checkmark-payroll || rpm -q checkmark-payroll || checkmark-payroll --version
2. UPGRADE to newer than 3.9.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade checkmark-payroll
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade checkmark-payroll
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
checkmark multiledger UPGRADE
Affected: <= 7.0.1 · 6.0.3 · 6.0.5 · 7.0.0
Fixed in: newer than 7.0.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy multiledger || rpm -q multiledger || multiledger --version
2. UPGRADE to newer than 7.0.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade multiledger
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade multiledger
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
innermedia dynazip library DOWNGRADE
Affected: 5.00.00 · 5.00.01 · 5.00.02 · 5.00.03
Fixed in: no fixed release known
Safe to downgrade to: a release before 5.00.00
1. Check installed version
apt-cache policy dynazip-library || rpm -q dynazip-library || dynazip-library --version
2. No fixed release: DOWNGRADE to a release before 5.00.00 (Debian / Ubuntu)
apt-cache madison dynazip-library sudo apt install dynazip-library=<VERSION_BEFORE_5.00.00> sudo apt-mark hold dynazip-library
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list dynazip-library sudo dnf downgrade dynazip-library-<VERSION_BEFORE_5.00.00> sudo dnf versionlock add dynazip-library
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
realnetworks realone player DOWNGRADE
Affected: 1.0 · 2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy realone-player || rpm -q realone-player || realone-player --version
2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison realone-player sudo apt install realone-player=<VERSION_BEFORE_1.0> sudo apt-mark hold realone-player
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list realone-player sudo dnf downgrade realone-player-<VERSION_BEFORE_1.0> sudo dnf versionlock add realone-player
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
realnetworks realplayer DOWNGRADE
Affected: 10.0 · 10.0_6.0.12.690 · 10.0_beta · 10.5 · 10.5_6.0.12.1016_beta · 10.5_6.0.12.1040 · 10.5_6.0.12.1053
Fixed in: no fixed release known
Safe to downgrade to: a release before 10.0
1. Check installed version
apt-cache policy realplayer || rpm -q realplayer || realplayer --version
2. No fixed release: DOWNGRADE to a release before 10.0 (Debian / Ubuntu)
apt-cache madison realplayer sudo apt install realplayer=<VERSION_BEFORE_10.0> sudo apt-mark hold realplayer
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list realplayer sudo dnf downgrade realplayer-<VERSION_BEFORE_10.0> sudo dnf versionlock add realplayer
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2004-1094?

checkmark payroll: upgrade to newer than 3.9.6; multiledger: upgrade to newer than 7.0.1; dynazip library: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2004-1094 being exploited?

CVE-2004-1094 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2004-1094 affect?

CVE-2004-1094 affects checkmark payroll, multiledger, dynazip library. Severity is high (CVSS 10.0). Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in Rea

How urgent is CVE-2004-1094?

Priority 59/100. Critical severity; EPSS top 5%: very likely to be exploited

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.