Description (CNA)
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 before 42.2-8 |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 2:3.28.1-3.el8_10.1 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 0:3.28.0-2.el8_10.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 2:3.28.1-3.el8_2.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 2:3.28.1-3.el8_4.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Telecommunications Update Service | unaffected 2:3.28.1-3.el8_4.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | unaffected 2:3.28.1-3.el8_4.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 2:3.28.1-3.el8_6.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Service | unaffected 2:3.28.1-3.el8_6.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | unaffected 2:3.28.1-3.el8_6.1 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Extended Update Support | unaffected 2:3.28.1-3.el8_8.1 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 2:40.3-2.el9_6.1 before * |
| Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | unaffected 2:40.3-2.el9_0.1 before * |
| Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 2:40.3-2.el9_2.1 before * |
| Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 2:40.3-2.el9_4.1 before * |
| Red Hat / Red Hat Enterprise Linux 6 | unknown |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
| Red Hat / Red Hat Enterprise Linux 9 | affected |
CWE
CWE-601
References
- https://access.redhat.com/errata/RHSA-2025:4450
- https://access.redhat.com/errata/RHSA-2025:4451
- https://access.redhat.com/errata/RHSA-2025:4455
- https://access.redhat.com/errata/RHSA-2025:4456
- https://access.redhat.com/errata/RHSA-2025:4457
- https://access.redhat.com/errata/RHSA-2025:4505
- https://access.redhat.com/errata/RHSA-2025:4532
- https://access.redhat.com/errata/RHSA-2025:7430
- https://access.redhat.com/errata/RHSA-2025:7569
- https://access.redhat.com/security/cve/CVE-2025-3155
- https://bugzilla.redhat.com/show_bug.cgi?id=2357091
- https://gitlab.gnome.org/GNOME/yelp/-/issues/221
ADP enrichment
No English description supplied.
No English description supplied.