CVE-2024-6781

NameCVE-2024-6781
DescriptionPath traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
calibre (PTS)bullseye5.12.0+dfsg-1+deb11u2fixed
bullseye (security)5.12.0+dfsg-1+deb11u3fixed
bookworm6.13.0+repack-2+deb12u4fixed
sid, trixie7.22.0+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
calibresourcebullseye(not affected)
calibresourcebookworm(not affected)
calibresource(unstable)7.16.0+ds-1

Notes

[bookworm] - calibre <not-affected> (Vulnerable code not present)
[bullseye] - calibre <not-affected> (Vulnerable code not present)
https://starlabs.sg/advisories/24/24-6781/
https://bugs.launchpad.net/calibre/+bug/2075125
Introduced by: https://github.com/kovidgoyal/calibre/commit/b45ca52f0f99aaa6da040e594ce7ba3cc7145e02 (v6.16.0)
Fixed by: https://github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3a29038d9c4 (v7.16.0)

Search for package or bug name: Reporting problems