Unscored CVE-2018-7889 EUVD-2018-19601GHSA-7hmv-6p8v-7rmw

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbit…

Published Mar 8, 2018 · Updated Sep 17, 2024 · Assigned by mitre

Package: calibre Package: calibre Ecosystem: Debian Ecosystem: Ubuntu

Description

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	calibre	3.19.0+dfsg-1	—
Debian 13	calibre	3.19.0+dfsg-1	—
Debian 12	calibre	3.19.0+dfsg-1	—

Ubuntu