Internet Bug Bounty: CVE-2017-11367: Global buffer overflow (READ of size 4) in shoco C library

The shocodecompress function in the API in shoco through 2017-07-17 allows remote attackers to cause a denial of service buffer over-read and application crash via malformed compressed data. The vendor has been unresponsive since this was reported in February of 2017. ==19039==ERROR:...

CVE-2017-11367

CVE-2017-11367 affects the shoco C library’s shoco_decompress function in the API (up to 2017-07-17). A malformed compressed input can trigger a buffer over-read, causing a remote DoS and application crash. Public reports document a global-buffer-overflow symptom and a user-space crash (example s...