Zikk090

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to exhaust memory in applications reading entries asynchronously.

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.16.1 **Description** An attacker can craft a PDF file that leads to excessive memory consumption and long runtimes. This occurs when extracting text from a page containing numerous reused form XObjects, where a form invokes a child multiple times. This creates exponentially many traversal paths within the directed acyclic graph (a graph with no cycles) of the XObjects, specifically affecting the `PageObject. extract text()` and `PageObject.extract xform text()` functions. **Recommendations** Update to version 6.16.1. As a temporary workaround, apply the changes from PR #3966.