What’s Vulnerable › Vulnerabilities

CVE-2017-18234

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-03-15 · updated 2026-06-17
• Weakness: CWE-416

Description

An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 17.10
• Debian Linux: 7.0
• Exempi Project Exempi: before 2.4.3 — fixed in 2.4.3

How to fix

Upgrade to a fixed version: Exempi Project Exempi 2.4.3. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2019:2048
• https://bugs.freedesktop.org/show_bug.cgi?id=100397
• https://cgit.freedesktop.org/exempi/commit/?id=c26d5beb60a5a85f76259f50ed3e08c8169b0a0c
• https://lists.debian.org/debian-lts-announce/2018/03/msg00013.html
• https://usn.ubuntu.com/3668-1/
• https://access.redhat.com/errata/RHSA-2019:2048
• https://bugs.freedesktop.org/show_bug.cgi?id=100397
• https://cgit.freedesktop.org/exempi/commit/?id=c26d5beb60a5a85f76259f50ed3e08c8169b0a0c
• https://lists.debian.org/debian-lts-announce/2018/03/msg00013.html
• https://usn.ubuntu.com/3668-1/

Get alerted when CVE-2017-18234 or the next vulnerability affects your stack