calibre is vulnerable to arbitrary code execution when opening FB2 files
Résumé
calibre is vulnerable to arbitrary code execution when opening FB2 files
Description d'origine
La description telle que publiée par la source (souvent en anglais).
calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve arbitrary code execution. This issue is fixed in version 8.14.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-64486 calibre Corrigé dans: 5.12.0+dfsg-1+deb11u4
- Ubuntu UBUNTU-CVE-2025-64486 calibre
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com