Bug 20225 - calibre new security issues CVE-2016-10187
Summary: calibre new security issues CVE-2016-10187
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: https://lwn.net/Vulnerabilities/713991/
Whiteboard: MGA5-32-OK mga5-64-ok advisory
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2017-02-01 02:20 CET by David Walser
Modified: 2017-02-12 16:12 CET (History)
5 users (show)

See Also:
Source RPM: calibre-2.20.0-1.1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-02-01 02:20:53 CET
A CVE has been assigned for an issue fixed upstream in calibre 2.75.0:
http://openwall.com/lists/oss-security/2017/01/31/9

The commit that fixed the issue is linked in the message above.
Comment 1 Atilla ÖNTAŞ 2017-02-04 22:21:07 CET
Newer devices like Kobo Aura HD requires newer versions of calibre for their new firmwares. Current calibre package does not support them.

Also, our current calibre packages in both core and backports repositories have a security issue (CVE-2016-10187). Newer versions of calibre 2.75.0 + fixes this issue. So, i decided to update leaf package calibre-2.78.0 to Mageia 5.1

Testing procedure not covers all features of calibre since it has way much more features those cannot be listed here. So i cover main functionalities below.

Testing Procedure for functionality:
1- After installing calibre-2.78.0 open it via your desktop's menu.
2- Create a new library and try to import some e-books into it.
3- Try to edit a books details by right clicking and selecting "Edit metadata" > "Edit metadata individually" see if getting metadata from internet or other options work.
4- Try to convert an e-book format into another e-book format
5- Try to export all or few e-books into your e-book reader.


Source Rpms in core/backports_testing:

calibre-2.78.0-1.mga5.src.rpm

Rpms in core/backports_testing:

calibre-2.78.0-1.mga5.i586.rpm
calibre-2.78.0-1.mga5.x86_64.rpm

URL: (none) => https://bugs.launchpad.net/calibre/+bug/1651728
Assignee: tarakbumba => qa-bugs

Comment 2 Atilla ÖNTAŞ 2017-02-04 22:22:00 CET
Sorry, correct repos are:

Source Rpms in core/updates_testing:

calibre-2.78.0-1.mga5.src.rpm

Rpms in core/updates_testing:

calibre-2.78.0-1.mga5.i586.rpm
calibre-2.78.0-1.mga5.x86_64.rpm

CC: (none) => tarakbumba

Comment 3 Herman Viaene 2017-02-08 14:00:54 CET
MGA5-32 on Asus A6000VM Xfce
No installation issues
Exercized first three steps of Comment 1 successfully. I have no ebook reader, so I amnot familiar with those formats, if the "higher powers" agree, this is OK for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA5-32-OK

Comment 4 Lewis Smith 2017-02-09 10:10:56 CET
Prior to testing x64, @Atilla
I have downloaded e-books in .pdf .epub .mobi
Are these 3 enough? If not, is there any other free format one can download?
Do we offer an e-book reader - in which case, what?
TIA

CC: (none) => lewyssmith

Comment 5 Atilla ÖNTAŞ 2017-02-09 10:39:26 CET
Thank you for your testing Herman.

(In reply to Lewis Smith from comment #4)
> Prior to testing x64, @Atilla
> I have downloaded e-books in .pdf .epub .mobi
> Are these 3 enough? If not, is there any other free format one can download?
> Do we offer an e-book reader - in which case, what?
> TIA

Lewis, i think those formats are enough. Altough pdf to other formats converting isn't satisfactionary with all utilities including calibre.

We don't offer an e-book reader but if you have one, try a supported one i.e. kobo or kindle brands.
Comment 6 Brian Rockwell 2017-02-09 16:16:44 CET
$ uname -a
Linux localhost 4.4.39-server-1.mga5 #1 SMP Fri Dec 16 19:07:42 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux


To satisfy dependencies, the following package(s) also need to be installed:

- lib64chm0-0.40-11.mga5.x86_64
- lib64podofo0.9.3-0.9.3-5.mga5.x86_64
- lib64qt5qml5-5.4.2-1.mga5.x86_64
- lib64qt5quick5-5.4.2-1.mga5.x86_64
- lib64qt5sql5-5.4.2-1.1.mga5.x86_64
- lib64qt5webkit5-5.4.2-1.mga5.x86_64
- lib64qt5webkitwidgets5-5.4.2-1.mga5.x86_64
- lib64qtsvg5-5.4.2-1.mga5.x86_64
- poppler-0.26.5-2.1.mga5.x86_64
- python-apsw-3.7.17.r1-7.mga5.x86_64
- python-babel-1.3-8.mga5.noarch
- python-beautifulsoup-3.2.1-8.mga5.noarch
- python-cherrypy-3.8.0-1.mga5.noarch
- python-clientform-0.2.10-10.mga5.noarch
- python-cssselect-0.9.1-5.mga5.noarch
- python-cssutils-0.9.10-7.mga5.noarch
- python-dateutil-2.1-8.mga5.noarch
- python-dnspython-1.11.1-7.mga5.noarch
- python-genshi-0.7-9.mga5.x86_64
- python-mechanize-0.2.5-9.mga5.noarch
- python-netifaces-0.10.4-8.mga5.x86_64
- python-odf-0.9.6-7.mga5.noarch
- python-pkg-resources-3.6-7.mga5.noarch
- python-pycrypto-2.6.1-6.1.mga5.x86_64
- python-pypdf-1.13-9.mga5.noarch
- python-pytz-2014.7-4.mga5.noarch
- python-qt5-core-5.4.2-1.mga5.x86_64
- python-qt5-gui-5.4.2-1.mga5.x86_64
- python-qt5-network-5.4.2-1.mga5.x86_64
- python-qt5-printsupport-5.4.2-1.mga5.x86_64
- python-qt5-svg-5.4.2-1.mga5.x86_64
- python-qt5-webkit-5.4.2-1.mga5.x86_64
- python-qt5-webkitwidgets-5.4.2-1.mga5.x86_64
- python-qt5-widgets-5.4.2-1.mga5.x86_64
- python-setuptools-3.6-7.mga5.noarch
- python-sip-4.16.9-1.mga5.x86_64
- python-six-1.7.3-4.mga5.noarch
- python3-babel-1.3-8.mga5.noarch
- python3-pytz-2014.7-4.mga5.noarch

175MB of additional disk space will be used.



I was able to install an epub file from gutenberg.org, update metadata and transfer to my nook.  Able to read it on the nook.

Works

Keywords: (none) => validated_update
Whiteboard: MGA5-32-OK => MGA5-32-OK mga5-64-ok
CC: (none) => brtians1, sysadmin-bugs

Comment 7 Lewis Smith 2017-02-09 20:13:22 CET
@David & Atilla
We need an Advisory. I am happy to construct one from the bug title and comments 1 & 2 if you agree. Let me know.
Comment 8 Atilla ÖNTAŞ 2017-02-10 07:51:40 CET
(In reply to Lewis Smith from comment #7)
> @David & Atilla
> We need an Advisory. I am happy to construct one from the bug title and
> comments 1 & 2 if you agree. Let me know.

IPlease go ahead.Thank you.
Comment 9 Lewis Smith 2017-02-11 09:49:22 CET
Advisory created from title, comments 0, 1, 2.

Whiteboard: MGA5-32-OK mga5-64-ok => MGA5-32-OK mga5-64-ok advisory

Comment 10 Mageia Robot 2017-02-12 00:48:10 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0047.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2017-02-12 16:12:24 CET

URL: https://bugs.launchpad.net/calibre/+bug/1651728 => https://lwn.net/Vulnerabilities/713991/


Note You need to log in before you can comment on or make changes to this bug.