Bug 34173 - yelp and yelp-xsl new security issue CVE-2025-3155
Summary: yelp and yelp-xsl new security issue CVE-2025-3155
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-04-07 10:54 CEST by Nicolas Salguero
Modified: 2025-11-15 08:17 CET (History)
4 users (show)

See Also:
Source RPM: yelp-42.2-1.mga9.src.rpm, yelp-xsl-42.1-1.mga9.src.rpm
CVE: CVE-2025-3155
Status comment:


Attachments

Description Nicolas Salguero 2025-04-07 10:54:22 CEST
CVE-2025-3155 was announced here:
https://www.openwall.com/lists/oss-security/2025/04/04/1
Nicolas Salguero 2025-04-07 10:55:13 CEST

Source RPM: (none) => yelp-42.2-3.mga10.src.rpm, yelp-42.2-1.mga9.src.rpm
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2025-3155
Status comment: (none) => Patch available from upstream

Comment 1 Lewis Smith 2025-04-07 21:06:20 CEST
"While there are proposed patches in the bug report, none seem to have been
committed to the git repo yet."

 https://gitlab.gnome.org/GNOME/yelp/-/issues/221
is the upstream link in the openwall URL; I got denied access. You might do better.

Assignee: bugsquad => gnome

Comment 2 Dan Fandrich 2025-04-19 22:21:00 CEST
The issue reporter recommends that distros apply the patches even though they're not yet accepted upstream: https://blogs.gnome.org/mcatanzaro/2025/04/15/dangerous-arbitrary-file-read-vulnerability-in-yelp-cve-2025-3155/

CC: (none) => dan

Comment 3 Dan Fandrich 2025-04-19 22:24:26 CEST
Correction: it's a GNOME contributor who recommends applying the patches, not the reporter (although, the same is implied there as well). That 221 issue link works fine for men once past the anti-bot script.
Comment 4 Nicolas Salguero 2025-05-23 09:08:32 CEST
Fedora has issued advisories on May 21:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27Z5WA2SKQGJ4UVVHUNWY73Y4PNKT3AA/ (yelp)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNBXVCRWOMV4OCPACFVW6R4I6T4PSAEM/ (yelp-xsl)

Summary: yelp new security issue CVE-2025-3155 => yelp and yelp-xsl new security issue CVE-2025-3155
Source RPM: yelp-42.2-3.mga10.src.rpm, yelp-42.2-1.mga9.src.rpm => yelp-42.2-3.mga10.src.rpm, yelp-42.2-1.mga9.src.rpm, yelp-xsl-42.1-1.mga9.src.rpm

Comment 5 Nicolas Salguero 2025-05-28 16:57:35 CEST
openSUSE has issued an advisory on May 27:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/T4HL3S3XNP5C4Q7YW3W22GDBDEEXQDW2/
Nicolas Salguero 2025-11-13 16:43:40 CET

Whiteboard: MGA9TOO => (none)
Source RPM: yelp-42.2-3.mga10.src.rpm, yelp-42.2-1.mga9.src.rpm, yelp-xsl-42.1-1.mga9.src.rpm => yelp-42.2-1.mga9.src.rpm, yelp-xsl-42.1-1.mga9.src.rpm
Version: Cauldron => 9

Comment 6 Nicolas Salguero 2025-11-13 16:57:16 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. (CVE-2025-3155)

References:
https://www.openwall.com/lists/oss-security/2025/04/04/1
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27Z5WA2SKQGJ4UVVHUNWY73Y4PNKT3AA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNBXVCRWOMV4OCPACFVW6R4I6T4PSAEM/
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/T4HL3S3XNP5C4Q7YW3W22GDBDEEXQDW2/
========================

Updated packages in core/updates_testing:
========================
lib64yelp-devel-42.2-1.1.mga9
lib64yelp0-42.2-1.1.mga9
yelp-42.2-1.1.mga9
yelp-xsl-42.1-1.1.mga9

from SRPMS:
yelp-42.2-1.1.mga9.src.rpm
yelp-xsl-42.1-1.1.mga9.src.rpm

Status comment: Patch available from upstream => (none)
Assignee: gnome => qa-bugs
Status: NEW => ASSIGNED

katnatek 2025-11-13 19:47:30 CET

Keywords: (none) => advisory

Comment 7 Herman Viaene 2025-11-14 11:12:40 CET
MGA9-64 server Plasma Wayland on Compaq H000SB.
No installation issues.
The Bugzilla column in the updates list, shows nothing else. So just trying the yelp command. That works well, I did some reading on the help files.
As for yelp-xsl, I have no idea how to test. The Gnome gitlab states
"yelp-xsl is a collection of programs and data files to help you build, maintain, and distribute documentation. It provides XSLT stylesheets that can be built upon for help viewers and publishing systems. These stylesheets output JavaScript and CSS content, and reference images provided by yelp-xsl. This package also redistributes copies of the jQuery and jQuery.Syntax JavaScript libraries."
That does not help me. Further googling neither.

CC: (none) => herman.viaene

Comment 8 katnatek 2025-11-14 21:35:15 CET
installing yelp-42.2-1.1.mga9.x86_64.rpm lib64yelp0-42.2-1.1.mga9.x86_64.rpm yelp-xsl-42.1-1.1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ###################################################################################################
      1/3: yelp-xsl              ###################################################################################################
      2/3: lib64yelp0            ###################################################################################################
      3/3: yelp                  ###################################################################################################
      1/3: removing yelp-42.2-1.mga9.x86_64
                                 ###################################################################################################
      2/3: removing yelp-xsl-42.1-1.mga9.noarch
                                 ###################################################################################################
      3/3: removing lib64yelp0-42.2-1.mga9.x86_64
                                 ###################################################################################################

Open yelp browse the help, as note before the update the gnome-boxes help didn't open and does now after update

Not find POC to test

Whiteboard: (none) => MGA9-64-OK

Comment 9 Thomas Andrews 2025-11-15 02:53:24 CET
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 10 Mageia Robot 2025-11-15 08:17:58 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0297.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.