CVE-2008-4420: Filestream Turbozip

High severity, CVSS 9.3. EPSS: 5.7% chance of exploitation in the next 30 days.

Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance Agent C.04.70 and C.04.72, TurboZIP 6.0, and other products; allow user-assisted attackers to execute arbitrary code via a long filename in a ZIP archive during a (1) Fix (aka Repair), (2) Add, (3) Update, or (4) Freshen action, a related issue to CVE-2006-3985.

Affected products

• Filestream Turbozip: version 6.0 only
• HP OpenView Performance Agent: version c.04.60 only; version c.04.70 only; version c.04.72 only
• Innermedia Dynazip Max: up to and including 5.0.0.7
• Innermedia Dynazip Max Secure: up to and including 6.0.0.4

Published 2009-04-13. Last modified 2026-06-16.