CVE-2025-3155
03.04.2025, 14:15
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
| Vendor | Product | Version |
|---|---|---|
| gnome | yelp | 42.2-8 |
| debian | debian_linux | 11.0 |
| redhat | codeready_linux_builder | 8.0 |
| redhat | codeready_linux_builder | 9.0 |
| redhat | codeready_linux_builder_for_arm64 | 8.0_aarch64:_aarch64 |
| redhat | codeready_linux_builder_for_arm64 | 9.0_aarch64:_aarch64 |
| redhat | codeready_linux_builder_for_arm64_eus | 8.8_aarch64:_aarch64 |
| redhat | codeready_linux_builder_for_arm64_eus | 9.2_aarch64:_aarch64 |
| redhat | codeready_linux_builder_for_arm64_eus | 9.4_aarch64:_aarch64 |
| redhat | codeready_linux_builder_for_arm64_eus | 9.6_aarch64:_aarch64 |
| redhat | codeready_linux_builder_for_eus | 8.8 |
| redhat | codeready_linux_builder_for_eus | 9.2 |
| redhat | codeready_linux_builder_for_eus | 9.4 |
| redhat | codeready_linux_builder_for_ibm_z_systems | 8.0_s390x:_s390x |
| redhat | codeready_linux_builder_for_ibm_z_systems | 9.0_s390x:_s390x |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | 8.8_s390x:_s390x |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | 9.2_s390x:_s390x |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | 9.4_s390x:_s390x |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | 9.6_s390x:_s390x |
| redhat | codeready_linux_builder_for_power_little_endian | 8.0_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_power_little_endian | 9.0_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_power_little_endian_eus | 8.8_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_power_little_endian_eus | 9.2_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_power_little_endian_eus | 9.4_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_power_little_endian_eus | 9.6_ppc64le:_ppc64le |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux_eus | 9.2 |
| redhat | enterprise_linux_eus | 9.4 |
| redhat | enterprise_linux_eus | 9.6 |
| redhat | enterprise_linux_for_arm_64 | 8.0 |
| redhat | enterprise_linux_for_arm_64 | 8.8_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64 | 9.0_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64 | 9.2_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64_eus | 9.4_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64_eus | 9.6_aarch64:_aarch64 |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems | 9.0_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.8_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.2_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.4_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.6_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 8.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian | 9.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.8_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.2_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.4_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_aus | 8.2 |
| redhat | enterprise_linux_server_aus | 8.4 |
| redhat | enterprise_linux_server_aus | 8.6 |
| redhat | enterprise_linux_server_aus | 9.2 |
| redhat | enterprise_linux_server_aus | 9.4 |
| redhat | enterprise_linux_server_aus | 9.6 |
| redhat | enterprise_linux_server_tus | 8.4 |
| redhat | enterprise_linux_server_tus | 8.6 |
| redhat | enterprise_linux_server_tus | 8.8 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.4 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.6 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.8 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.0 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.2 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-829 - Inclusion of Functionality from Untrusted Control SphereThe software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
References