CVE-2017-9620

Name	CVE-2017-9620
Description	The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document, related to the xps_encode_font_char_imp function.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	869879

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ghostscript (PTS)	bullseye	9.53.3~dfsg-7+deb11u7	fixed
	bullseye (security)	9.53.3~dfsg-7+deb11u9	fixed
	bookworm	10.0.0~dfsg-11+deb12u5	fixed
	bookworm (security)	10.0.0~dfsg-11+deb12u6	fixed
	trixie	10.04.0~dfsg-1	fixed
	sid	10.04.0~dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
ghostscript	source	wheezy	(not affected)
ghostscript	source	jessie	(not affected)
ghostscript	source	(unstable)	9.22~dfsg-1	unimportant	869879

Notes

[jessie] - ghostscript <not-affected> (Vulnerable code not present)
[wheezy] - ghostscript <not-affected> (Vulnerable code not present)
The Debian binary package is not affected xps/ not used
https://bugs.ghostscript.com/show_bug.cgi?id=698050
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3ee55637480d5e319a5de0481b01c3346855cbc9