Описание
Security update for yelp
This update for yelp fixes the following issue
- CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625).
Список пакетов
openSUSE Leap 16.0
libyelp0-42.3-160000.3.1
yelp-42.3-160000.3.1
yelp-devel-42.3-160000.3.1
yelp-lang-42.3-160000.3.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1269625
- SUSE CVE CVE-2026-13601 page
Описание
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
Затронутые продукты
openSUSE Leap 16.0:libyelp0-42.3-160000.3.1
openSUSE Leap 16.0:yelp-42.3-160000.3.1
openSUSE Leap 16.0:yelp-devel-42.3-160000.3.1
openSUSE Leap 16.0:yelp-lang-42.3-160000.3.1
Ссылки
- CVE-2026-13601
- SUSE Bug 1269625