CVE-2017-18234

Vulnerability

Exempi versions prior to 2.4.3 contain a use-after-free vulnerability in the TIFF metadata reconciliation code. The flaw resides in XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, TIFF_MemoryReader.cpp, and TIFF_Support.hpp. When processing a PDF file that embeds JPEG data, an invalid memcpy operation can trigger a use-after-free condition. The issue is reachable without special configuration; any application using Exempi to parse XMP metadata from PDF files is affected.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious PDF file containing specially crafted JPEG data. The victim must open the file with an application that uses Exempi to extract XMP metadata (e.g., a media library or image viewer). No authentication or special network position is required; the attack is remote if the file is delivered via email, web download, or other means. The exploitation sequence involves the application parsing the PDF, which triggers the flawed TIFF reconciliation code, leading to the use-after-free.

Impact

Successful exploitation results in a denial of service (application crash or hang) due to memory corruption. Additionally, the Ubuntu security advisory [2] notes that arbitrary code execution may be possible, depending on the memory layout and attacker control. The compromise occurs at the privilege level of the user running the application that uses Exempi.

Mitigation

The vulnerability is fixed in Exempi version 2.4.3 [1][2]. Red Hat Enterprise Linux and Ubuntu have released updated packages (e.g., RHSA-2019:2048 [1] and USN-3668-1 [2]). Users should upgrade to the patched version or apply the vendor-supplied updates. No workarounds are documented; the only mitigation is to update Exempi.