Remote Code Execution Vulnerability in Calibre by Kovid Goyal
CVE-2018-7889

7.8HIGH

Key Information:

Vendor

Calibre-ebook

Status
Calibre
Vendor
CVE Published:
8 March 2018

What is CVE-2018-7889?

A vulnerability in Calibre version 3.18 permits remote attackers to execute arbitrary code by exploiting the handling of bookmark data through crafted .pickle files. This issue arises in the gui2/viewer/bookmarkmanager.py file where the cPickle.load function is misused, allowing attackers to manipulate the application into executing dangerous commands.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://bugs.launchpad.net/calibre/+bug/1753870
x_refsource_CONFIRM
https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf...
x_refsource_CONFIRM

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

JSON
.