CVE-2017-9740

Name	CVE-2017-9740
Description	The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	869879

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ghostscript (PTS)	bullseye	9.53.3~dfsg-7+deb11u7	fixed
	bullseye (security)	9.53.3~dfsg-7+deb11u8	fixed
	bookworm	10.0.0~dfsg-11+deb12u5	fixed
	bookworm (security)	10.0.0~dfsg-11+deb12u6	fixed
	sid, trixie	10.04.0~dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
ghostscript	source	wheezy	(not affected)
ghostscript	source	jessie	(not affected)
ghostscript	source	(unstable)	9.22~dfsg-1	unimportant	869879

Notes

[jessie] - ghostscript <not-affected> (Vulnerable code not present)
[wheezy] - ghostscript <not-affected> (Vulnerable code not present)
The Debian binary package is not affected xps/ not used
https://bugs.ghostscript.com/show_bug.cgi?id=698064
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=961b10cdd71403072fb99401a45f3bef6ce53626