Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3036-1

Опубликовано: 15 июл. 2026
Источник: suse-cvrf

Описание

Security update for yelp

This update for yelp fixes the following issue

  • CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625).

Список пакетов

SUSE Linux Enterprise Module for Desktop Applications 15 SP7
libyelp0-42.2-150600.3.6.1
yelp-42.2-150600.3.6.1
yelp-devel-42.2-150600.3.6.1
yelp-lang-42.2-150600.3.6.1
SUSE Linux Enterprise Server 15 SP6-LTSS
libyelp0-42.2-150600.3.6.1
yelp-42.2-150600.3.6.1
yelp-devel-42.2-150600.3.6.1
yelp-lang-42.2-150600.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
libyelp0-42.2-150600.3.6.1
yelp-42.2-150600.3.6.1
yelp-devel-42.2-150600.3.6.1
yelp-lang-42.2-150600.3.6.1

Ссылки

Описание

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

Затронутые продукты
SUSE Linux Enterprise Module for Desktop Applications 15 SP7:libyelp0-42.2-150600.3.6.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7:yelp-42.2-150600.3.6.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7:yelp-devel-42.2-150600.3.6.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7:yelp-lang-42.2-150600.3.6.1
Ссылки