Package: calibre Severity: normal Tags: security Calibre contains a plugin updater, which appears to operate by downloading this url:
MR_URL = 'http://www.mobileread.com/forums/' MR_INDEX_URL = MR_URL + 'showpost.php?p=1362767&postcount=1' This is a forum page, accessed in the clear, and belonging to an entity apparently unrelated to calibre. To update a plugin calibre downloads an extracts a zip file that probably contains unsandboxed executable code, with no validation, beyond this: if not question_dialog(self, _('Install %s')%display_plugin.name, '<p>' + \ _('Installing plugins is a <b>security risk</b>. ' 'Plugins can contain a virus/malware. ' 'Only install it if you got it from a trusted source.' ' Are you sure you want to proceed?'), I am not sure if this requires the user to click on something to install updates or not, but either way this is pretty crap WRT security and should be disabled. -- System Information: Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Kernel: Linux 3.0.0-1-686-pae (SMP w/2 CPU cores) Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- see shy jo
signature.asc
Description: Digital signature
