CVE-2016-10187
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a...
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
- Record
CVE-2016-10187- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
- Record
CVE-2016-10187- Updated
- 2026-11-02
EUVDEUVD-2016-1374 No score
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
- Record
EUVD-2016-1374- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xwhv-5h8x-ff8f
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a...
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
- Record
GHSA-xwhv-5h8x-ff8f- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
- Record
CVE-2016-10187- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10187
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
- Record
DEBIAN-CVE-2016-10187- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10187
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
- Record
UBUNTU-CVE-2016-10187- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0047 No score
Updated calibre packages fix security vulnerability
Newer devices like Kobo Aura HD requires newer versions of calibre for their new firmwares. Current calibre package does not support them.
Also, our current calibre packages in both core and backports repositories have a security issue (CVE-2016-10187). Newer versions of calibre 2.75.0 + fixes this issue.
- Record
MGASA-2017-0047- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
calibreDebian:12 |
before 2.75.1+dfsg-1 | 2.75.1+dfsg-1 |
calibreDebian:13 |
before 2.75.1+dfsg-1 | 2.75.1+dfsg-1 |
calibreDebian:14 |
before 2.75.1+dfsg-1 | 2.75.1+dfsg-1 |
calibreDebian:7 |
before 0.8.51+dfsg1-0.1+deb7u1, plus listed versions 0.8.51+dfsg1-0.1 |
0.8.51+dfsg1-0.1+deb7u1 |
calibreMageia:5 |
before 2.78.0-1.mga5 | 2.78.0-1.mga5 |
calibreUbuntu:16.04:LTS |
All versions, plus listed versions 2.33.0+dfsg-1build12.38.0+dfsg-12.45.0+dfsg-12.45.0+dfsg-1build12.48.0+dfsg-1 Show 4 moreShow less2.48.0+dfsg-1build12.54.0+dfsg-12.55.0+dfsg-12.55.0+dfsg-1ubuntu0.2 |
None known |
calibreUbuntu:26.04:LTS |
All versions, plus listed versions 8.8.0+ds-3build18.13.0+ds+~0.10.5-38.14.0+ds+~0.10.5-18.15.0+ds+~0.10.5-18.16.0+ds+~0.10.5-2 Show 4 moreShow less8.16.2+ds+~0.10.5-18.16.2+ds+~0.10.5-28.16.2+ds+~0.10.5-39.2.1+ds+~0.10.5-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10187 is a medium vulnerability (CVSS 5.5) in Calibre-ebook Calibre, published February 11, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in calibre 2.75.1+dfsg-1.