821 matches found
[ASA-201803-8] calibre: arbitrary command execution
Arch Linux Security Advisory ASA-201803-8 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-7889 Package : calibre Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-650 Summary ======= The package calibre before...
Calibre Arbitrary Code Execution Vulnerability
Calibre is a free and open source e-book management software. The software provides functions such as formatting books and categorizing and organizing e-books. A security vulnerability exists in the gui2/viewer/bookmarkmanager.py file in Calibre version 3.18. The vulnerability can be exploited by...
CVE-2018-7889
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
DEBIAN-CVE-2018-7889
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
Design/Logic Flaw
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
UBUNTU-CVE-2018-7889
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
CVE-2018-7889
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
CVE-2018-7889
Summary: CVE-2018-7889 affects Calibre (notably 3.18) where gui2/viewer/bookmarkmanager.py uses cPickle.load on imported bookmark data, enabling arbitrary code execution through a crafted .pickle file. The underlying issue is deserialization of untrusted data leading to remote code execution. Con...
CVE-2018-7889
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
CVE-2018-7889
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
CVE-2018-7889: Deserialization of Untrusted Data
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...
Debian: Security Advisory (DLA-859-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Updated podofo packages fix security vulnerability
The podofo package has been updated to fix several security issues. The krename and calibre packages have been rebuilt against the updated podofo...
MGASA-2018-0026 Updated podofo packages fix security vulnerability
The podofo package has been updated to fix several security issues. The krename and calibre packages have been rebuilt against the updated podofo...
Debian DLA-859-1 : calibre security update
It was found that a JavaScript present in the book can access files on the computer using XMLHttpRequest. For Debian 7 'Wheezy', these problems have been fixed in version 0.8.51+dfsg1-0.1+deb7u1. We recommend that you upgrade your calibre packages. NOTE: Tenable Network Security has extracted the...
[SECURITY] [DLA 859-1] calibre security update
Package : calibre Version : 0.8.51+dfsg1-0.1+deb7u1 CVE ID : CVE-2016-10187 Debian Bug : 853004 It was found that a javascript present in the book can access files on the computer using XMLHttpRequest. For Debian 7 "Wheezy", these problems have been fixed in version 0.8.51+dfsg1-0.1+deb7u1. We...
DLA-859-1 calibre - security update
Bulletin has no description...
Code injection
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript...
