CVE-2024-6782

NameCVE-2024-6782
DescriptionImproper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
calibre (PTS)bullseye5.12.0+dfsg-1+deb11u2fixed
bullseye (security)5.12.0+dfsg-1+deb11u3fixed
bookworm6.13.0+repack-2+deb12u4fixed
sid, trixie7.20.0+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
calibresourcebullseye(not affected)
calibresourcebookworm6.13.0+repack-2+deb12u4
calibresource(unstable)7.16.0+ds-1

Notes

[bullseye] - calibre <not-affected> (Vulnerable code not present)
https://starlabs.sg/advisories/24/24-6782/
https://bugs.launchpad.net/calibre/+bug/2075128
Fixed by: https://github.com/kovidgoyal/calibre/commit/38a1bf50d8cd22052ae59c513816706c6445d5e9 (v7.16.0)
Introduced in: https://github.com/kovidgoyal/calibre/commit/1ecb96d76a7ff5269b3a85472cc64fe834407b60 (v6.9.0)

Search for package or bug name: Reporting problems