CVE-2024-7009: Calibre SQL Injection
Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/calibreto a version that resolves this vulnerability.Fixed in 6.13.0+repack-2+deb12u4 - Upgrade
Upgrade
debian/calibreto a version that resolves this vulnerability.Fixed in 7.16.0+ds-1 - Upgrade
Upgrade
debian/calibreto a version that resolves this vulnerability.Fixed in 6.13.0+repack-2+deb12u9Fixed in 6.13.0+repack-2+deb12u10Fixed in 8.5.0+ds-1+deb13u3Fixed in 9.17.0+ds+~1.1.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7009?
CVE-2024-7009 is classified as a high severity vulnerability due to its potential for SQL injection.
How do I fix CVE-2024-7009?
To remediate CVE-2024-7009, update to a version of Calibre greater than 7.15.0 that includes the necessary security patches.
What type of vulnerability is CVE-2024-7009?
CVE-2024-7009 is an SQL injection vulnerability resulting from unsanitized user input.
Who is affected by CVE-2024-7009?
CVE-2024-7009 affects users of Calibre versions 7.15.0 and earlier with permission to perform full-text searches.
What are the potential impacts of CVE-2024-7009?
The potential impacts of CVE-2024-7009 include unauthorized data access, data manipulation, and compromise of the SQLite database.