This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-7889 →

DEBIAN-CVE-2018-7889

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code v...

Original description

The description as published by the source.

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 calibre

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0+dfsg-1"}]}]

Debian:13 calibre

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0+dfsg-1"}]}]

Debian:14 calibre

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0+dfsg-1"}]}]

References

advisory security-tracker.debian.org