calibre - Debian Package Tracker

general

source: calibre (main)
version: 9.17.0+ds+~1.1.2-1
maintainer: Calibre maintainer team (DMD)
uploaders: Martin Pitt [DMD] – YOKOTA Hiroshi [DMD] [DM] – Nicholas D Steeves [DMD]
arch: all amd64 arm64 armhf i386
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.12.0+dfsg-1+deb11u2
o-o-sec: 5.12.0+dfsg-1+deb11u5
o-o-p-u: 5.12.0+dfsg-1+deb11u2
oldstable: 6.13.0+repack-2+deb12u9
old-sec: 6.13.0+repack-2+deb12u10
old-p-u: 6.13.0+repack-2+deb12u9
stable: 8.5.0+ds-1+deb13u3
stable-bpo: 8.16.2+ds+~0.10.5-3~bpo13+1
testing: 9.17.0+ds+~1.1.2-1
unstable: 9.17.0+ds+~1.1.2-1

versioned links

5.12.0+dfsg-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.12.0+dfsg-1+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.13.0+repack-2+deb12u9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.13.0+repack-2+deb12u10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.5.0+ds-1+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.16.2+ds+~0.10.5-3~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.17.0+ds+~1.1.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

calibre (30 bugs: 0, 20, 10, 0)
calibre-bin

action needed

Marked for autoremoval on 22 November due to debugpy, ipykernel, ipython, jupyter-server-terminals, jupyterlab, pydevd, python-botocore, python-django, python-hypothesis, python-syrupy: #1126323, #1145153, #1145330, #1145439, #1145458, #1146434, #1147441, #1147480, #1149388, #1149942, #1150176 high

Version 9.17.0+ds+~1.1.2-1 of calibre is marked for autoremoval from testing on Sun 22 Nov 2026. It depends (transitively) on debugpy, ipykernel, ipython, jupyter-server-terminals, jupyterlab, pydevd, python-botocore, python-django, python-hypothesis, python-syrupy, affected by #1126323, #1145153, #1145330, #1145439, #1145458, #1146434, #1147441, #1147480, #1149388, #1149942, #1150176. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-10-23 Last update: 2026-10-28 16:33

3 security issues in bullseye high

There are 3 open security issues in bullseye.

2 important issues:

CVE-2026-73248: calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
CVE-2026-73249: calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

1 ignored issue:

CVE-2026-25731: calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.

Created: 2026-08-12 Last update: 2026-09-01 12:03

3 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit e9ae2443df82f8a60ed789fb91657e6fd951ab87
Merge: 2c665a5e 18c7ef9e
Author: YOKOTA Hiroshi <yokota.hgml@gmail.com>
Date:   Tue Oct 27 08:56:06 2026 +0900

    Merge branches 'dependabot/pip/brotli-1.2.1' and 'dependabot/pip/setuptools-84.1.0'

commit 18c7ef9ec0779088653be4037afa1583e33b9afd
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Fri Oct 23 23:46:34 2026 +0000

    Bump setuptools from 83.0.0 to 84.1.0
    
    Bumps [setuptools](https://github.com/pypa/setuptools) from 83.0.0 to 84.1.0.
    - [Release notes](https://github.com/pypa/setuptools/releases)
    - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
    - [Commits](https://github.com/pypa/setuptools/compare/v83.0.0...v84.1.0)
    
    ---
    updated-dependencies:
    - dependency-name: setuptools
      dependency-version: 84.1.0
      dependency-type: direct:development
    ...
    
    Signed-off-by: dependabot[bot] <support@github.com>

commit 2c665a5e0e0b7eae5a878c33ae83a4ba158ff87e
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Fri Oct 23 23:46:33 2026 +0000

    Bump brotli from 1.2.0 to 1.2.1
    
    Bumps [brotli](https://github.com/google/brotli) from 1.2.0 to 1.2.1.
    - [Release notes](https://github.com/google/brotli/releases)
    - [Changelog](https://github.com/google/brotli/blob/go/brotli/v1.2.1/CHANGELOG.md)
    - [Commits](https://github.com/google/brotli/compare/v1.2.0...go/brotli/v1.2.1)
    
    ---
    updated-dependencies:
    - dependency-name: brotli
      dependency-version: 1.2.1
      dependency-type: direct:production
    ...
    
    Signed-off-by: dependabot[bot] <support@github.com>

Created: 2026-10-27 Last update: 2026-10-28 09:04

AppStream hints: 2 warnings for calibre normal

AppStream found metadata issues for packages:

calibre: 2 warnings

You should get rid of them to provide more metadata about this software.

Created: 2025-08-10 Last update: 2025-08-10 23:01

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-73248: (needs triaging) calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
CVE-2026-73249: (needs triaging) calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

You can find information about how to handle these issues in the security team's documentation.

1 issue that should be fixed with the next stable update:

CVE-2026-53511: calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.

Created: 2026-02-08 Last update: 2026-10-26 18:19

debian/patches: 4 patches to forward upstream low

Among the 25 debian patches available in version 9.17.0+ds+~1.1.2-1 of the package, we noticed the following issues:

4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-07-20 Last update: 2026-10-24 17:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-02-26 Last update: 2026-10-10 14:30

testing migrations

This package will soon be part of the auto-onnxruntime transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-10-27] calibre 9.17.0+ds+~1.1.2-1 MIGRATED to testing (Debian testing watch)
[2026-10-24] Accepted calibre 9.17.0+ds+~1.1.2-1 (source) into unstable (YOKOTA Hiroshi)
[2026-10-13] calibre 9.16.0+ds+~1.1.2-1 MIGRATED to testing (Debian testing watch)
[2026-10-09] Accepted calibre 9.16.0+ds+~1.1.2-1 (source) into unstable (YOKOTA Hiroshi)
[2026-10-04] calibre 9.15.0+ds+~1.1.2-3 MIGRATED to testing (Debian testing watch)
[2026-09-23] Accepted calibre 9.15.0+ds+~1.1.2-3 (source) into unstable (YOKOTA Hiroshi)
[2026-09-20] Accepted calibre 9.15.0+ds+~1.1.2-2 (source) into unstable (YOKOTA Hiroshi)
[2026-09-18] Accepted calibre 9.15.0+ds+~1.1.2-1 (source) into unstable (YOKOTA Hiroshi)
[2026-09-02] calibre 9.14.0+ds+~0.10.6-2 MIGRATED to testing (Debian testing watch)
[2026-08-29] Accepted calibre 9.14.0+ds+~0.10.6-2 (source) into unstable (YOKOTA Hiroshi)
[2026-08-28] Accepted calibre 9.14.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-08-18] Accepted calibre 6.13.0+repack-2+deb12u10 (source amd64 all) into oldstable-security (Abhijith PA)
[2026-08-09] calibre 9.13.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-08-07] Accepted calibre 9.13.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-08-02] calibre 9.12.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-07-31] Accepted calibre 9.12.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-07-29] Accepted calibre 5.12.0+dfsg-1+deb11u5 (source) into oldoldstable-security (Abhijith PA)
[2026-07-15] calibre 9.11.0+ds+~0.10.6-2 MIGRATED to testing (Debian testing watch)
[2026-07-12] Accepted calibre 9.11.0+ds+~0.10.6-2 (source) into unstable (YOKOTA Hiroshi)
[2026-07-03] Accepted calibre 9.11.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-06-29] calibre 9.10.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-06-28] Accepted calibre 9.10.0+ds+~0.10.6-2 (source) into unstable (YOKOTA Hiroshi)
[2026-06-26] Accepted calibre 9.10.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-06-09] calibre 9.9.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-06-02] Accepted calibre 8.5.0+ds-1+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-31] Accepted calibre 6.13.0+repack-2+deb12u9 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-28] Accepted calibre 9.9.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-05-25] Accepted calibre 6.13.0+repack-2+deb12u8 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-24] Accepted calibre 6.13.0+repack-2+deb12u7 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-24] calibre 9.8.0+ds+~0.10.6-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 31
RC: 0
I&N: 20
M&W: 10
F&P: 1
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 31)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 9.14.0+ds+~0.10.6-2ubuntu1
95 bugs
patches for 9.14.0+ds+~0.10.6-2ubuntu1