Skip to content

CVE-2004-1010

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder...

10.0 HighFix available

CVE-2004-1010 is a high vulnerability (CVSS 10.0) in Info-zip Zip, published November 9, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.25%, the 95th percentile. Fixed in zip 2.30-8.

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Exploit likelihood

9.25%Down 3.0 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Record: CVE-2004-1010
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Record: CVE-2004-1010
Updated: 2026-11-02

EUVDEUVD-2004-1008 No score

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Record: EUVD-2004-1008
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5w78-c2f4-q879 No score

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder...

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Record: GHSA-5w78-c2f4-q879
Updated: 2026-11-02

OSV No score

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Record: CVE-2004-1010
Updated: 2026-11-02

OSVDEBIAN-CVE-2004-1010 No score

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Record: DEBIAN-CVE-2004-1010
Updated: 2026-11-02

Affected products

info-zip zip

Affected packages

Affected packages
Package	Affected	Fixed
`zip` Debian:12	before 2.30-8	2.30-8
`zip` Debian:13	before 2.30-8	2.30-8
`zip` Debian:14	before 2.30-8	2.30-8
`zip` Debian:3.0	before 2.30-5woody2, plus listed versions 2.30-5	2.30-5woody2
`zip` Red Hat:enterprise_linux:3::as	before 0:2.3-16.1	0:2.3-16.1
`zip-debuginfo` Red Hat:enterprise_linux:3::as	before 0:2.3-16.1	0:2.3-16.1
`zip` Red Hat:enterprise_linux:3::desktop	before 0:2.3-16.1	0:2.3-16.1
`zip-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:2.3-16.1	0:2.3-16.1
`zip` Red Hat:enterprise_linux:3::es	before 0:2.3-16.1	0:2.3-16.1
`zip-debuginfo` Red Hat:enterprise_linux:3::es	before 0:2.3-16.1	0:2.3-16.1
`zip` Red Hat:enterprise_linux:3::ws	before 0:2.3-16.1	0:2.3-16.1
`zip-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:2.3-16.1	0:2.3-16.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 21 moreShow less