clamav: denial of service through "better zip bomb"
https://www.openwall.com/lists/oss-security/2019/08/06/3 [www.openwall.com]
2019-08-06 16:43
Recently David Fifield presented a new variant of a ZIP bomb where by using overlapping segments he was able to achieve very high compression ratios (42kb->5GB, 10MB->281TB).
However David Fifield commented in the bug report [4] that the fix is incomplete, by using some slight variations of his methods he could bypass the fix.
This shouldn’t be anything new, but... oops. Plus some commentary about age browsing, etc.
source: L