Every CVE Search/ Get API key

CVE-2017-18237

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in...

5.5 MediumFix available

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.15%Up 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Record
CVE-2017-18237
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Record
CVE-2017-18237
Updated
2026-11-02
EUVDEUVD-2017-9369 No score

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Record
EUVD-2017-9369
Updated
2026-11-03
GitHub AdvisoriesGHSA-j3wm-c6rh-6rw8 5.5

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in...

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Record
GHSA-j3wm-c6rh-6rw8
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 5.5

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Record
CVE-2017-18237
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-18237 5.5

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Record
DEBIAN-CVE-2017-18237
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2018-0239 No score

Updated exempi package fixes security vulnerabilities

An issue was discovered in Exempi through 2.4.4. There is a stack-based buffer over-read in the PostScript_MetaHandler::ParsePSFile() function in PostScript_Handler.cpp (CVE-2018-7729).

An issue was discovered in Exempi through 2.4.4. WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class (CVE-2018-7731).

An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file (CVE-2017-18233).

An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to ReconcileTIFF.cpp, TIFF_MemoryReader.cpp, and TIFF_Support.hpp (CVE-2017-18234).

An issue was discovered in Exempi before 2.4.3. The VPXChunk class in WEBP_Support.cpp does not ensure nonzero widths and heights, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted .webp file (CVE-2017-18235).

An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file (CVE-2017-18236).

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file (CVE-2017-18237).

Record
MGASA-2018-0239
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
exempi
Debian:12
 before 2.4.3-1
2.4.3-1
exempi
Debian:13
 before 2.4.3-1
2.4.3-1
exempi
Debian:14
 before 2.4.3-1
2.4.3-1
exempi
Mageia:6
 before 2.4.5-1.mga6
2.4.5-1.mga6

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-18237 is a medium vulnerability (CVSS 5.5) in Exempi Project Exempi, published March 15, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 67th percentile. Fixed in exempi 2.4.3-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open