Updated calibre packages fix security vulnerability

2018-10-1921:00:37

Gentoo Foundation

advisories.mageia.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.006

Percentile

79.5%

JSON

Updated calibre package fixes security vulnerability: gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call (CVE-2018-7889). The python-html5-parser package is a new dependency for the updated calibre package and has been included with this update.

OSVersionArchitecturePackageVersionFilename
Mageia6noarchcalibre< 3.27.1-2calibre-3.27.1-2.mga6
Mageia6noarchpython-html5-parser< 0.4.4-1.1python-html5-parser-0.4.4-1.1.mga6
Mageia6noarchpython-lxml< 3.8.0-1.1python-lxml-3.8.0-1.1.mga6

OS	Version	Architecture	Package	Version	Filename
Mageia	6	noarch	calibre	< 3.27.1-2	calibre-3.27.1-2.mga6
Mageia	6	noarch	python-html5-parser	< 0.4.4-1.1	python-html5-parser-0.4.4-1.1.mga6
Mageia	6	noarch	python-lxml	< 3.8.0-1.1	python-lxml-3.8.0-1.1.mga6