CVE-2018-7889: High severity Calibre-ebook Calibre vulnerability

Published Mar 8, 2018

Updated

gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.

Affected Software

1 affected component

Calibre-ebook Calibre=3.18.0

Remediation

Patch Available

https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf657951756688b3c72bd68b6e4a7d

Event History

Mar 8, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

via NVD·09:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2018-7889?

CVE-2018-7889 is a vulnerability in Calibre 3.18 that allows remote attackers to execute arbitrary code by importing a crafted .pickle file containing Python code with an os.system call.

How does CVE-2018-7889 affect Calibre?

CVE-2018-7889 affects Calibre 3.18, allowing remote attackers to execute arbitrary code.

What is the severity of CVE-2018-7889?

CVE-2018-7889 has a severity rating of 7.8 (high).

How can I fix CVE-2018-7889 in Calibre?

To fix CVE-2018-7889 in Calibre, update to a version higher than 3.18.0.

Are there any references related to CVE-2018-7889?

Yes, you can find more information about CVE-2018-7889 at the following references: [Link 1](https://bugs.launchpad.net/calibre/+bug/1753870), [Link 2](https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf657951756688b3c72bd68b6e4a7d).