Vulnerability in calibre - security update
Summary
DLA-859-1: calibre - security update. Affects calibre versions < 0.8.51+dfsg1-0.1+deb7u1. Fixed in 0.8.51+dfsg1-0.1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Calibre is an open-source e-book management tool that allows users to organize, convert, and read e-books in various formats. It provides a comprehensive set of features for managing e-books, including library management, e-book conversion, syncing with e-book readers, and more. However, a security vulnerability has been discovered in calibre that allows a malicious JavaScript present in a book to access files on the user's computer using XMLHttpRequest.
Vulnerability Detail
The vulnerability in calibre arises from the ability of JavaScript code within a book to make unauthorized requests to the user's file system using the XMLHttpRequest object. This can potentially lead to unauthorized access to sensitive files on the user's computer. The vulnerability affects calibre versions prior to 0.8.51+dfsg1-0.1+deb7u1 on Debian 7 Wheezy.
How To Fix
Minimum fixed version
0.8.51+dfsg1-0.1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade calibreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, a security vulnerability has been discovered in calibre that allows a malicious JavaScript present in a book to access files on the user's computer. To mitigate this vulnerability, it is recommended to upgrade the calibre package to version 0.8.51+dfsg1-0.1+deb7u1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for calibre →
FAQ
Calibre is an open-source e-book management tool that allows users to organize, convert, and read e-books in various formats.
The vulnerability allows a malicious JavaScript present in a book to access files on the user's computer, potentially leading to unauthorized access to sensitive files.
The vulnerability affects calibre versions prior to 0.8.51+dfsg1-0.1+deb7u1 on Debian 7 Wheezy.
To fix the vulnerability, it is recommended to upgrade the calibre package to version 0.8.51+dfsg1-0.1+deb7u1 or later.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for calibre.
