Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2008-4420: Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0

61
This week
HIGH 9.3DOWNGRADEUPGRADEUPGRADE

CVE-2008-4420 is a high-severity flaw (CVSS 9.3) affecting openview performance agent, dynazip max, dynazip max secure. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance Agent C.04.70 and C.04.72, TurboZIP 6.0, and other products; allow user-assisted attackers to execute arbitrary code via a long filename in a ZIP archive during a (1) Fix (aka Repair), (2) Add, (3) Update, or (4) Freshen action, a related issue to C

Why this priority

  • Critical severity
  • EPSS top 7%: very likely to be exploited
  • Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score9.3 (High)
EPSS exploit chance5.7% (top 7%)
CISA exploited listNo
WeaknessCWE-119
Published2009-04-13
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: filestream · hp · innermedia

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

hp openview performance agent DOWNGRADE
Affected: c.04.60 · c.04.70 · c.04.72
Fixed in: no fixed release known
Safe to downgrade to: a release before c.04.60
1. Check installed version
apt-cache policy openview-performance-agent || rpm -q openview-performance-agent || openview-performance-agent --version
2. No fixed release: DOWNGRADE to a release before c.04.60 (Debian / Ubuntu)
apt-cache madison openview-performance-agent sudo apt install openview-performance-agent=<VERSION_BEFORE_c.04.60> sudo apt-mark hold openview-performance-agent
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openview-performance-agent sudo dnf downgrade openview-performance-agent-<VERSION_BEFORE_c.04.60> sudo dnf versionlock add openview-performance-agent
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
innermedia dynazip max UPGRADE
Affected: <= 5.0.0.7
Fixed in: newer than 5.0.0.7
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy dynazip-max || rpm -q dynazip-max || dynazip-max --version
2. UPGRADE to newer than 5.0.0.7 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade dynazip-max
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade dynazip-max
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
innermedia dynazip max secure UPGRADE
Affected: <= 6.0.0.4
Fixed in: newer than 6.0.0.4
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy dynazip-max-secure || rpm -q dynazip-max-secure || dynazip-max-secure --version
2. UPGRADE to newer than 6.0.0.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade dynazip-max-secure
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade dynazip-max-secure
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
filestream turbozip DOWNGRADE
Affected: 6.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.0
1. Check installed version
apt-cache policy turbozip || rpm -q turbozip || turbozip --version
2. No fixed release: DOWNGRADE to a release before 6.0 (Debian / Ubuntu)
apt-cache madison turbozip sudo apt install turbozip=<VERSION_BEFORE_6.0> sudo apt-mark hold turbozip
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list turbozip sudo dnf downgrade turbozip-<VERSION_BEFORE_6.0> sudo dnf versionlock add turbozip
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2008-4420?

openview performance agent: downgrade or apply the listed mitigation; dynazip max: upgrade to newer than 5.0.0.7; dynazip max secure: upgrade to newer than 6.0.0.4. Exact commands for each OS are on this page.

Is CVE-2008-4420 being exploited?

CVE-2008-4420 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2008-4420 affect?

CVE-2008-4420 affects openview performance agent, dynazip max, dynazip max secure. Severity is high (CVSS 9.3). Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance Agent C.04.70 and C.04.72, TurboZIP 6.0

How urgent is CVE-2008-4420?

Priority 61/100. Critical severity; EPSS top 7%: very likely to be exploited; Public exploit reference

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.