CVE-2017-18238

An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .qt file.

• CWE-835

• https://access.redhat.com/errata/RHSA-2019:2048
• https://bugs.freedesktop.org/show_bug.cgi?id=102483Exploit, Issue Tracking
• https://cgit.freedesktop.org/exempi/commit/?id=886cd1d2314755adb1f4cdb99c16ff00830f0331Patch
• https://lists.debian.org/debian-lts-announce/2018/03/msg00013.htmlThird Party Advisory
• https://usn.ubuntu.com/3668-1/
• https://access.redhat.com/errata/RHSA-2019:2048
• https://bugs.freedesktop.org/show_bug.cgi?id=102483Exploit, Issue Tracking
• https://cgit.freedesktop.org/exempi/commit/?id=886cd1d2314755adb1f4cdb99c16ff00830f0331Patch
• https://lists.debian.org/debian-lts-announce/2018/03/msg00013.htmlThird Party Advisory
• https://usn.ubuntu.com/3668-1/

Published

Mar 15, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18232The Serial Attached SCSI (SAS) implementation in the Linux k…
• CVE-2017-18233An issue was discovered in Exempi before 2.4.4. Integer over…
• CVE-2017-18234An issue was discovered in Exempi before 2.4.3. It allows re…
• CVE-2017-18235An issue was discovered in Exempi before 2.4.3. The VPXChunk…
• CVE-2017-18236An issue was discovered in Exempi before 2.4.4. The ASF_Supp…
• CVE-2017-18237An issue was discovered in Exempi before 2.4.3. The PostScri…
• CVE-2017-18239A time-sensitive equality check on the JWT signature in the …
• CVE-2017-1824Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18240The Gentoo app-admin/collectd package before 5.7.2-r1 sets t…
• CVE-2017-18241fs/f2fs/segment.c in the Linux kernel before 4.13 allows loc…
• CVE-2017-18242The apply_dependent_coupling function in libavcodec/aacdec.c…
• CVE-2017-18243The unpack_parse_unit function in libavcodec/dirac_parser.c …