CVE-2017-18237 Null dereference in n/a

Medium 5.5 Published 15 Mar 2018 Updated 17 Sep 2024

Remote attackers can cause a denial of service via a crafted PostScript file due to an invalid pointer dereference in the Exempi library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2017-18237?

CVE-2017-18237 is a medium-severity vulnerability in n/a, published on 15 Mar 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XMPFiles/source/FormatSupport/PostScript_Support.cpp allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted .ps file.

Weakness: CWE-476

Which versions are affected by CVE-2017-18237?

It affects 1 product.

Products include Exempi Project Exempi.

How do I fix CVE-2017-18237?

Upgrade to a fixed version.

Is CVE-2017-18237 being exploited?

There is no known exploitation of CVE-2017-18237 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2017-18237, GHSA-j3wm-c6rh-6rw8.