{"id":"CVE-2016-10187","aliases":["DEBIAN-CVE-2016-10187","DLA-859-1","EUVD-2016-1374","GHSA-xwhv-5h8x-ff8f","MGASA-2017-0047","UBUNTU-CVE-2016-10187"],"status":"published","title":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a...","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02793,"percentile":0.8651,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2017-02-11T23:47:14Z","modified":"2026-10-20T10:47:04Z","fixes":[{"ecosystem":"Debian:12","package":"calibre","fixed_in":["2.75.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"calibre","fixed_in":["2.75.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"calibre","fixed_in":["2.75.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"calibre","fixed_in":["0.8.51+dfsg1-0.1+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"calibre","fixed_in":["2.78.0-1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"calibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.75.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"calibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.75.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"calibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.75.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"calibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.51+dfsg1-0.1+deb7u1"}]}],"versions":["0.8.51+dfsg1-0.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"calibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.78.0-1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"calibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.33.0+dfsg-1build1","2.38.0+dfsg-1","2.45.0+dfsg-1","2.45.0+dfsg-1build1","2.48.0+dfsg-1","2.48.0+dfsg-1build1","2.54.0+dfsg-1","2.55.0+dfsg-1","2.55.0+dfsg-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"calibre","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.8.0+ds-3build1","8.13.0+ds+~0.10.5-3","8.14.0+ds+~0.10.5-1","8.15.0+ds+~0.10.5-1","8.16.0+ds+~0.10.5-2","8.16.2+ds+~0.10.5-1","8.16.2+ds+~0.10.5-2","8.16.2+ds+~0.10.5-3","9.2.1+ds+~0.10.5-2build1"]}],"products":[{"vendor":"calibre-ebook","product":"calibre"}],"references":[{"url":"https://bugs.launchpad.net/calibre/+bug/1651728","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/29/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/31/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","fix"]},{"url":"https://github.com/kovidgoyal/calibre/commit/3a89718664cb8c","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/95909","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10187"},{"url":"https://github.com/advisories/GHSA-xwhv-5h8x-ff8f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10187","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0047.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20225","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2017/01/31/9","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10187","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10187","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-10187","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","status":"published","published":"2017-03-16T15:00:00Z","modified":"2024-08-06T03:14:42.791Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1374","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","status":"published","published":"2017-03-16T15:00:00Z","modified":"2024-08-06T03:14:42Z","updated_at":"2026-11-03T02:22:24.738409Z"}],"ghsa":[{"id":"GHSA-xwhv-5h8x-ff8f","title":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a...","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","status":"published","published":"2022-05-17T02:54:34Z","modified":"2023-01-27T05:06:05Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:42:49.857991Z"}],"nvd":[{"id":"CVE-2016-10187","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","status":"published","published":"2017-03-16T15:59:00.837Z","modified":"2026-06-17T00:39:14.45Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-10187","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","status":"published","published":"2017-03-16T15:59:00.837Z","modified":"2026-10-20T10:47:04.760626451Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10187","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","status":"published","published":"2017-03-16T15:59:00.837Z","modified":"2026-09-22T07:00:17.427052693Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-10187","description":"The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.","status":"published","published":"2017-03-16T15:59:00Z","modified":"2026-05-20T16:03:19.111421904Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-859-1","title":"calibre - security update","status":"published","published":"2017-03-17T00:00:00Z","modified":"2026-03-09T02:11:33.346257Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"MGASA-2017-0047","title":"Updated calibre packages fix security vulnerability","description":"Newer devices like Kobo Aura HD requires newer versions of calibre for\ntheir new firmwares. Current calibre package does not support them.\n\nAlso, our current calibre packages in both core and backports\nrepositories have a security issue (CVE-2016-10187). Newer versions of\ncalibre 2.75.0 + fixes this issue.\n","status":"published","published":"2017-02-11T23:47:14Z","modified":"2026-04-16T06:23:43.362876852Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}