Description
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | yelp | 2.22.1-4 | — |
| Debian 13 | yelp | 2.22.1-4 | — |
| Debian 12 | yelp | 2.22.1-4 | — |
| Debian 5.0 | yelp | 2.22.1-3+lenny2 | DTSA-154-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Yelp 2.23.1 - Invalid URI Format String EDB-32248 · dos · Aug 13, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DTSA-154-1 yelp - format string vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugzilla.gnome.org/attachment.cgi?id=115890
- 31465 third-party-advisory
- 30690 vdb-entry
- SUSE-SR:2008:024 vendor-advisory
- 31620 third-party-advisory
- USN-638-1 vendor-advisory
- 32629 third-party-advisory
- yelp-uri-format-string(44449) vdb-entry
- https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860
- 31834 third-party-advisory
- http://bugzilla.gnome.org/show_bug.cgi?id=546364
- ADV-2008-2393 vdb-entry
- FEDORA-2008-7293 vendor-advisory
- MDVSA-2008:175 vendor-advisory