Summary
It was discovered that Yelp allowed help documents to execute arbitrary
scripts. An attacker could possibly use this issue to trick a user into
opening a specially crafted help document and obtain sensitive information.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | yelp | 3.18.1-1ubuntu4+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | yelp | 3.26.0-1ubuntu2+esm2 |
Vulnerabilities 1
-
High 7.4CVE-2025-3155 EPSS 13%
Yelp: arbitrary file read
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
References
-
report
https://ubuntu.com/security/CVE-2025-3155