CVE-2018-7889

Summary: CVE-2018-7889 affects Calibre (notably 3.18) where gui2/viewer/bookmarkmanager.py uses cPickle.load on imported bookmark data, enabling arbitrary code execution through a crafted .pickle file. The underlying issue is deserialization of untrusted data leading to remote code execution. Con...

CVE-2018-7889

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...