Mageia alert MGASA-2025-0297 (yelp-xsl)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2025-0297: Updated yelp & yelp-xsl packages fix security vulnerability
Date:
             
 
Sat, 15 Nov 2025 08:12:21 +0100
Message-ID:
             
 
<20251115071221.450559FC3F@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2025-0297 - Updated yelp & yelp-xsl packages fix security vulnerability

Publication date: 15 Nov 2025
URL: https://advisories.mageia.org/MGASA-2025-0297.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2025-3155

Description:
The Gnome user help application allows the help document to execute
arbitrary scripts. This vulnerability allows malicious users to input
help documents, which may exfiltrate user files to an external
environment. (CVE-2025-3155)

References:
- https://bugs.mageia.org/show_bug.cgi?id=34173
- https://www.openwall.com/lists/oss-security/2025/04/04/1
-
https://lists.fedoraproject.org/archives/list/package-ann...
-
https://lists.fedoraproject.org/archives/list/package-ann...
-
https://lists.opensuse.org/archives/list/security-announc...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3155

SRPMS:
- 9/core/yelp-42.2-1.1.mga9
- 9/core/yelp-xsl-42.1-1.1.mga9