CVE-2018-7889

NameCVE-2018-7889
Descriptiongui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs892242

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
calibre (PTS)jessie2.5.0+dfsg-1vulnerable
stretch2.75.1+dfsg-1vulnerable
buster3.34.0+dfsg-1fixed
sid3.35.0+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
calibresource(unstable)3.19.0+dfsg-1medium892242

Notes

[stretch] - calibre <no-dsa> (Minor issue)
[jessie] - calibre <no-dsa> (Minor issue)
[wheezy] - calibre <no-dsa> (Minor issue)
https://bugs.launchpad.net/calibre/+bug/1753870
deserialization fix https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf657951756688b3c72bd68b6e4a7d
insufficient as import also loads configuration files, which are python executables,
see https://lists.debian.org/87muy0usv1.fsf@curie.anarc.at
The CVE assignment is specific to the issue fixed by upstream commit
aeb5b036a0bf657951756688b3c72bd68b6e4a7d.

Search for package or bug name: Reporting problems