Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3035-1

Опубликовано: 15 июл. 2026
Источник: suse-cvrf

Описание

Security update for yelp

This update for yelp fixes the following issue

  • CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625).

Список пакетов

SUSE Linux Enterprise Server 12 SP5-LTSS
libyelp0-3.20.1-7.6.1
yelp-3.20.1-7.6.1
yelp-devel-3.20.1-7.6.1
yelp-lang-3.20.1-7.6.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
libyelp0-3.20.1-7.6.1
yelp-3.20.1-7.6.1
yelp-devel-3.20.1-7.6.1
yelp-lang-3.20.1-7.6.1

Ссылки

Описание

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:libyelp0-3.20.1-7.6.1
SUSE Linux Enterprise Server 12 SP5-LTSS:yelp-3.20.1-7.6.1
SUSE Linux Enterprise Server 12 SP5-LTSS:yelp-devel-3.20.1-7.6.1
SUSE Linux Enterprise Server 12 SP5-LTSS:yelp-lang-3.20.1-7.6.1
Ссылки