CVE-2018-7889

NameCVE-2018-7889
Descriptiongui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs892242

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
calibre (PTS)buster3.39.1+dfsg-3fixed
bullseye5.12.0+dfsg-1+deb11u1fixed
bookworm6.13.0+repack-2+deb12u3fixed
trixie7.5.1+ds-3fixed
sid7.7.0+ds-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
calibresource(unstable)3.19.0+dfsg-1892242

Notes

[stretch] - calibre <no-dsa> (Minor issue)
[jessie] - calibre <no-dsa> (Minor issue)
[wheezy] - calibre <no-dsa> (Minor issue)
https://bugs.launchpad.net/calibre/+bug/1753870
deserialization fix https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf657951756688b3c72bd68b6e4a7d
insufficient as import also loads configuration files, which are python executables,
see https://lists.debian.org/87muy0usv1.fsf@curie.anarc.at
The CVE assignment is specific to the issue fixed by upstream commit
aeb5b036a0bf657951756688b3c72bd68b6e4a7d.

Search for package or bug name: Reporting problems