Описание
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 3.19.0+dfsg-1 |
| cosmic | not-affected | 3.19.0+dfsg-1 |
| devel | not-affected | 9.2.1+ds+~0.10.5-2build1 |
| disco | not-affected | 3.19.0+dfsg-1 |
| eoan | not-affected | 3.19.0+dfsg-1 |
| esm-apps-legacy/xenial | needed | |
| esm-apps/bionic | not-affected | 3.19.0+dfsg-1 |
| esm-apps/focal | not-affected | 3.19.0+dfsg-1 |
| esm-apps/jammy | not-affected | 3.19.0+dfsg-1 |
Показывать по
EPSS
6.8 Medium
CVSS2
7.8 High
CVSS3
Связанные уязвимости
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on i ...
gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
ALT-PU-2018-1454: package `calibre` update to version 3.19.0-alt1
EPSS
6.8 Medium
CVSS2
7.8 High
CVSS3