Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3037-1

Опубликовано: 15 июл. 2026
Источник: suse-cvrf

Описание

Security update for yelp

This update for yelp fixes the following issue

  • CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1
SUSE Linux Enterprise Server 15 SP4-LTSS
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1
SUSE Linux Enterprise Server 15 SP5-LTSS
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
libyelp0-41.2-150400.3.6.1
yelp-41.2-150400.3.6.1
yelp-devel-41.2-150400.3.6.1
yelp-lang-41.2-150400.3.6.1

Ссылки

Описание

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libyelp0-41.2-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:yelp-41.2-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:yelp-devel-41.2-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:yelp-lang-41.2-150400.3.6.1
Ссылки