Multiple vulnerabilities have been discovered in calibre, an e-book manager CVE-2025-64486 calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the. Debian LTS Advisory DLA-4554-1
Update to 9.6.0. Fixes rhbz#2452087. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-7de23151cd 2026-04-25 01:21:36.171214+00:00 -------------------------------------------------------------------------------- Name : calibre Product : Fedora 44 Version : 9.6.0 Release : 1.fc44 URL : https://calibre-ebook.com/ Summary : E-book converter and library manager Description : Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the concept of the logical book, i.e. a single entry in the database that may correspond to ebooks in several formats. It also supports conversion to and from a dozen different ebook formats. Supported input formats are: MOBI, LIT, PRC, EPUB, CHM, ODT, HTML, CBR, CBZ, RTF, TXT, PDF and LRS. -------------------------------------------------------------------------------- Update Information: Update to 9.6.0. Fixes rhbz#2452087 -------------------------------------------------------------------------------- ChangeLog: * Sun Mar 29 2026 Kevin Fenzi - 9.6.0-1 - Update to 9.6.0. Fixes rhbz#2452087 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2452087 - calibre-9.6.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2452087 [ 2 ] Bug #2452379 - CVE-2026-33205 calibre: server-side request forgery in ebook viewer backend [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452379 [ 3 ] Bug #2452380 - CVE-2026-33206 calibre: path traversal allows reading arbitrary files when converting a text-based file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452380 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-7de23151cd' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update to 9.6.0. Fixes rhbz#2452087. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-9cc418c23e 2026-04-07 00:49:46.037802+00:00 -------------------------------------------------------------------------------- Name : calibre Product : Fedora 43 Version : 9.6.0 Release : 1.fc43 URL : https://calibre-ebook.com/ Summary : E-book converter and library manager Description : Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the concept of the logical book, i.e. a single entry in the database that may correspond to ebooks in several formats. It also supports conversion to and from a dozen different ebook formats. Supported input formats are: MOBI, LIT, PRC, EPUB, CHM, ODT, HTML, CBR, CBZ, RTF, TXT, PDF and LRS. -------------------------------------------------------------------------------- Update Information: Update to 9.6.0. Fixes rhbz#2452087 -------------------------------------------------------------------------------- ChangeLog: * Sun Mar 29 2026 Kevin Fenzi - 9.6.0-1 - Update to 9.6.0. Fixes rhbz#2452087 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2452087 - calibre-9.6.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2452087 [ 2 ] Bug #2452379 - CVE-2026-33205 calibre: server-side request forgery in ebook viewer backend [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452379 [ 3 ] Bug #2452380 - CVE-2026-33206 calibre: path traversal allows reading arbitrary files when converting a text-based file [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2452380 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9cc418c23e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update to 8.14.0. Fixes rhbz#2413304. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-355be35bb1 2025-11-24 01:24:44.272905+00:00 -------------------------------------------------------------------------------- Name : calibre Product : Fedora 43 Version : 8.14.0 Release : 1.fc43 URL : https://calibre-ebook.com/ Summary : E-book converter and library manager Description : Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the concept of the logical book, i.e. a single entry in the database that may correspond to ebooks in several formats. It also supports conversion to and from a dozen different ebook formats. Supported input formats are: MOBI, LIT, PRC, EPUB, CHM, ODT, HTML, CBR, CBZ, RTF, TXT, PDF and LRS. -------------------------------------------------------------------------------- Update Information: Update to 8.14.0. Fixes rhbz#2413304 -------------------------------------------------------------------------------- ChangeLog: * Sat Nov 15 2025 Kevin Fenzi - 8.14.0-1 - Update to 8.14.0. Fixes rhbz#2413304 * Wed Nov 5 2025 Dominik 'Rathann' Mierzejewski - 8.13.0-2 - Rebuilt for FFmpeg 8 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2413304 - calibre-8.14.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2413304 [ 2 ] Bug #2414459 - CVE-2025-64486 calibre: calibre is vulnerable to arbitrary code execution when opening FB2 files [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2414459 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program.Use su -c 'dnf upgrade --advisory FEDORA-2025-355be35bb1' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. (CVE-2023-46303) Path traversal in Calibre
Multiple vulnerabilities have been discovered in calibre, the worst of which could lead to remote code execution.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202409-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: calibre: Multiple Vulnerabilities Date: September 22, 2024 Bugs: #918429, #936961 ID: 202409-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in calibre, the worst of which could lead to remote code execution. Background ========== calibre is a powerful and easy to use e-book manager. Affected packages ================= Package Vulnerable Unaffected ---------------- ------------ ------------ app-text/calibre < 7.16.0 > = 7.16.0 Description =========== Multiple vulnerabilities have been discovered in calibre. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All calibre users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-text/calibre-7.16.0" References ========== [ 1 ] CVE-2023-46303 https://nvd.nist.gov/vuln/detail/CVE-2023-46303 [ 2 ] CVE-2024-6781 https://nvd.nist.gov/vuln/detail/CVE-2024-6781 [ 3 ] CVE-2024-6782 https://nvd.nist.gov/vuln/detail/CVE-2024-6782 [ 4 ] CVE-2024-7008 https://nvd.nist.gov/vuln/detail/CVE-2024-7008 [ 5 ] CVE-2024-7009 https://nvd.nist.gov/vuln/detail/CVE-2024-7009 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202409-04 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Two vulnerabilities have been fixed in the e-book manager Calibre. CVE-2021-44686 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3862-1
Fix fonts for < f41 releases. Upgrade to latest upstream release to fix 4 CVE's and enable new hardware. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-a455bea9ca 2024-08-27 17:07:11.621204 -------------------------------------------------------------------------------- Name : calibre Product : Fedora 40 Version : 7.17.0 Release : 3.fc40 URL : https://calibre-ebook.com/ Summary : E-book converter and library manager Description : Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the concept of the logical book, i.e. a single entry in the database that may correspond to ebooks in several formats. It also supports conversion to and from a dozen different ebook formats. Supported input formats are: MOBI, LIT, PRC, EPUB, CHM, ODT, HTML, CBR, CBZ, RTF, TXT, PDF and LRS. -------------------------------------------------------------------------------- Update Information: Fix fonts for < f41 releases. Upgrade to latest upstream release to fix 4 CVE's and enable new hardware -------------------------------------------------------------------------------- ChangeLog: * Sun Aug 25 2024 Kevin Fenzi - 7.17.0-2 - Fix font conditionals to handle f40 and older correctly * Sat Aug 24 2024 Kevin Fenzi - 7.17.0-1 - Update to 7.17.0. Fixes rhbz#2307557 * Wed Aug 21 2024 Parag Nemade - 7.16.0-3 - Update to use new Liberation fonts installation path for F41+ releases. * Thu Aug 15 2024 Kevin Fenzi - 7.16.0-2 - Remove pycryptdome as a BuildRequires * Sun Aug 4 2024 Kevin Fenzi - 7.16.0-1 - Update to calibre 7.16.0. Fixes rhbz#2302040 * Sat Jul 20 2024 Kevin Fenzi - 7.15.0-1 - Update to 7.15.0. Fixes rhbz#2298824 * Wed Jul 17 2024Fedora Release Engineering - 7.14.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Sat Jul 13 2024 Kevin Fenzi - 7.14.0-1 - Update to 7.14.0. Fixes rhbz#2297462 * Sun Jul 7 2024 Kevin Fenzi - 7.13.0-2 - correct path for liberation fonts -------------------------------------------------------------------------------- References: [ 1 ] Bug #2303060 - CVE-2024-7009 calibre: From NVD collector [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2303060 [ 2 ] Bug #2303063 - CVE-2024-7008 calibre: Unsanitized user-input in Calibre allow attackers to perform reflected cross-site scripting [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2303063 [ 3 ] Bug #2303065 - CVE-2024-6782 calibre: Improper access control in Calibre allow unauthenticated attackers to achieve remote code execution. [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2303065 [ 4 ] Bug #2303067 - CVE-2024-6781 calibre: Path traversal in Calibre allow unauthenticated attackers to achieve arbitrary file read. [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2303067 [ 5 ] Bug #2307794 - Crash at start of "calibre" https://bugzilla.redhat.com/show_bug.cgi?id=2307794 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-a455bea9ca' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.