Pavel Janík [ARCHIVE] on Nostr: 📅 Original date posted:2015-12-02 📝 Original message:> On 02 Dec 2015, at ...

📅 Original date posted:2015-12-02
📝 Original message:> On 02 Dec 2015, at 00:44, Simon Liu <simon at bitcartel.com> wrote:
>
> Hi Matt/Pavel,
>
> Why is it scary/undesirable? Thanks.

Select your preferable compression library and google for it with +CVE.

E.g. in zlib:

http://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-1820/GNU-Zlib.html

…allows remote attackers to cause a denial of service (crash) via a crafted compressed stream…
…allows remote attackers to cause a denial of service (application crash)…
etc.

Do you want to expose such lib to the potential attacker?
--
Pavel Janík