CVE-2017-18234: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only
• Debian Debian Linux: version 7.0 only
• Exempi Project Exempi: before 2.4.3 (fixed in 2.4.3)

Published 2018-03-15. Last modified 2026-06-17.