calibre - Debian Package Tracker

general

source: calibre (main)
version: 9.13.0+ds+~0.10.6-1
maintainer: Calibre maintainer team (DMD)
uploaders: YOKOTA Hiroshi [DMD] [DM] – Nicholas D Steeves [DMD] – Martin Pitt [DMD]
arch: all amd64 arm64 armhf i386
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.12.0+dfsg-1+deb11u2
o-o-sec: 5.12.0+dfsg-1+deb11u5
o-o-p-u: 5.12.0+dfsg-1+deb11u2
oldstable: 6.13.0+repack-2+deb12u9
old-sec: 6.13.0+repack-2+deb12u10
old-p-u: 6.13.0+repack-2+deb12u9
stable: 8.5.0+ds-1+deb13u3
stable-bpo: 8.16.2+ds+~0.10.5-3~bpo13+1
testing: 9.13.0+ds+~0.10.6-1
unstable: 9.13.0+ds+~0.10.6-1

versioned links

5.12.0+dfsg-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.12.0+dfsg-1+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.13.0+repack-2+deb12u9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.13.0+repack-2+deb12u10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.5.0+ds-1+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.16.2+ds+~0.10.5-3~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.13.0+ds+~0.10.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

calibre (30 bugs: 0, 20, 10, 0)
calibre-bin

action needed

Marked for autoremoval on 05 September due to httpcore, jupyter-notebook, node-playwright, node-yarnpkg, towncrier: #1135849, #1138720, #1141793, #1143321, #1143428, #1143952 high

Version 9.13.0+ds+~0.10.6-1 of calibre is marked for autoremoval from testing on Sat 05 Sep 2026. It depends (transitively) on httpcore, jupyter-notebook, node-playwright, node-yarnpkg, towncrier, affected by #1135849, #1138720, #1141793, #1143321, #1143428, #1143952. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-08-01 Last update: 2026-08-21 09:01

3 security issues in bullseye high

There are 3 open security issues in bullseye.

2 important issues:

CVE-2026-73248: calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
CVE-2026-73249: calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

1 ignored issue:

CVE-2026-25731: calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template-html or --template-html-index command-line options. This vulnerability is fixed in 9.2.0.

Created: 2026-08-12 Last update: 2026-08-18 11:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-73248: calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
CVE-2026-73249: calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Created: 2026-07-08 Last update: 2026-08-18 11:00

lintian reports 976 warnings normal

Lintian reports 976 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-31 Last update: 2026-07-31 20:32

AppStream hints: 2 warnings for calibre normal

AppStream found metadata issues for packages:

calibre: 2 warnings

You should get rid of them to provide more metadata about this software.

Created: 2025-08-10 Last update: 2025-08-10 23:01

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-73248: (needs triaging) calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
CVE-2026-73249: (needs triaging) calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

You can find information about how to handle these issues in the security team's documentation.

1 issue that should be fixed with the next stable update:

CVE-2026-53511: calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter. This issue is fixed in version 9.10.0.

Created: 2026-02-08 Last update: 2026-08-18 11:00

debian/patches: 4 patches to forward upstream low

Among the 24 debian patches available in version 9.13.0+ds+~0.10.6-1 of the package, we noticed the following issues:

4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2024-07-20 Last update: 2026-08-07 23:32

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-02-26 Last update: 2025-01-12 00:33

testing migrations

This package will soon be part of the auto-ffmpeg transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-onnxruntime transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-08-18] Accepted calibre 6.13.0+repack-2+deb12u10 (source amd64 all) into oldstable-security (Abhijith PA)
[2026-08-09] calibre 9.13.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-08-07] Accepted calibre 9.13.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-08-02] calibre 9.12.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-07-31] Accepted calibre 9.12.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-07-29] Accepted calibre 5.12.0+dfsg-1+deb11u5 (source) into oldoldstable-security (Abhijith PA)
[2026-07-15] calibre 9.11.0+ds+~0.10.6-2 MIGRATED to testing (Debian testing watch)
[2026-07-12] Accepted calibre 9.11.0+ds+~0.10.6-2 (source) into unstable (YOKOTA Hiroshi)
[2026-07-03] Accepted calibre 9.11.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-06-29] calibre 9.10.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-06-28] Accepted calibre 9.10.0+ds+~0.10.6-2 (source) into unstable (YOKOTA Hiroshi)
[2026-06-26] Accepted calibre 9.10.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-06-09] calibre 9.9.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-06-02] Accepted calibre 8.5.0+ds-1+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-31] Accepted calibre 6.13.0+repack-2+deb12u9 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-28] Accepted calibre 9.9.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-05-25] Accepted calibre 6.13.0+repack-2+deb12u8 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-24] Accepted calibre 6.13.0+repack-2+deb12u7 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-24] calibre 9.8.0+ds+~0.10.6-2 MIGRATED to testing (Debian testing watch)
[2026-05-22] Accepted calibre 9.8.0+ds+~0.10.6-2 (source) into unstable (YOKOTA Hiroshi)
[2026-05-21] calibre 9.8.0+ds+~0.10.6-1 MIGRATED to testing (Debian testing watch)
[2026-05-13] Accepted calibre 9.8.0+ds+~0.10.6-1 (source) into unstable (YOKOTA Hiroshi)
[2026-05-13] Accepted calibre 9.8.0+ds+~0.10.5-5 (source) into unstable (YOKOTA Hiroshi)
[2026-05-12] Accepted calibre 9.8.0+ds+~0.10.5-4 (source) into unstable (YOKOTA Hiroshi)
[2026-05-12] Accepted calibre 9.8.0+ds+~0.10.5-3 (source) into unstable (YOKOTA Hiroshi)
[2026-05-11] Accepted calibre 9.8.0+ds+~0.10.5-2 (source) into unstable (YOKOTA Hiroshi)
[2026-05-03] calibre 9.8.0+ds+~0.10.5-1 MIGRATED to testing (Debian testing watch)
[2026-05-02] Accepted calibre 6.13.0+repack-2+deb12u6 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-02] Accepted calibre 8.5.0+ds-1+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: YOKOTA Hiroshi)
[2026-05-01] Accepted calibre 9.8.0+ds+~0.10.5-1 (source) into unstable (YOKOTA Hiroshi)

bugs [bug history graph]

all: 31
RC: 0
I&N: 20
M&W: 10
F&P: 1
patch: 0

links

homepage
lintian (0, 976)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 30)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 9.13.0+ds+~0.10.6-1