UbuntuUpdates.org

Package "calibre-bin"

Name: calibre-bin

Description:

e-book converter and library management
Latest version: 2.55.0+dfsg-1ubuntu0.2
Release: xenial (16.04)
Level: security
Repository: universe
Head package: calibre
Homepage: http://calibre-ebook.com

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "calibre-bin"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "calibre-bin" in Xenial

Repository Area Version
base universe 2.55.0+dfsg-1
updates universe 2.55.0+dfsg-1ubuntu0.2
PPA: GetDeb Apps 2.85.1-1~getdeb1

Changelog

Version: 2.55.0+dfsg-1ubuntu0.2 2018-04-12 23:06:39 UTC

  calibre (2.55.0+dfsg-1ubuntu0.2) xenial-security; urgency=medium

  * SECURITY UPDATE: JavaScript in a book can access local files using
    XMLHttpRequest (LP: #1758699).
    - fix-CVE-2016-10187.patch
    - CVE-2016-10187
  * SECURITY UPDATE: Malicious code execution when using CPickle instead of
    JSON.
    - fix-CVE-2018-7889.patch
    - CVE-2018-7889

 -- Simon Quigley <email address hidden> Wed, 11 Apr 2018 23:50:09 -0500
1758699 [CVE] JavaScript in a book can access local files using XMLHttpRequest
CVE-2016-10187 The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
CVE-2018-7889 gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code


About   -   Send Feedback to @ubuntu_updates