oss-security - CVE-2025-3155 GNOME Yelp: Arbitrary file read by abusing ghelp scheme

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <c549b82a-ddd8-4ff0-ae8b-3fed9896f656@oracle.com>
Date: Fri, 4 Apr 2025 12:07:21 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-3155 GNOME Yelp: Arbitrary file read by
 abusing ghelp scheme

GNOME has issued CVE-2025-3155 for the following bug in Yelp, the help file
viewer in the GNOME Desktop (unrelated to the similarly named app for
restaurant reviews):

    https://gitlab.gnome.org/GNOME/yelp/-/issues/221

The description they landed on after analysis was:

    Yelp, the GNOME user help application, allows help documents to execute
    arbitrary JavaScript. A malicious help document may exfiltrate user files
    to a remote server. A malicious website may download a help document
    without user intervention, then trick the user into opening a ghelp URL
    that references the help document. This notably requires the attacker to
    guess the filesystem path of the downloaded help document.

While there are proposed patches in the bug report, none seem to have been
committed to the git repo yet.

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.