CVE 2016-10187

The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.

Related bugs and status

CVE-2016-10187 (Candidate) is related to these bugs:

Bug #1758699: [CVE] JavaScript in a book can access local files using XMLHttpRequest

		In	Importance	Status
1758699	[CVE] JavaScript in a book can access local files using XMLHttpRequest	calibre (Ubuntu)	Medium	Fix Released
1758699	[CVE] JavaScript in a book can access local files using XMLHttpRequest	calibre (Ubuntu Xenial)	Medium	Fix Released
1758699	[CVE] JavaScript in a book can access local files using XMLHttpRequest	calibre (Ubuntu Trusty)	Medium	Fix Released
1758699	[CVE] JavaScript in a book can access local files using XMLHttpRequest	calibre (Ubuntu Artful)	Medium	Fix Released

See the

CVE page on Mitre.org for more details.