Vulnerability Description
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Yelp | 42.2-8 |
| Debian | Debian Linux | 11.0 |
| Redhat | Codeready Linux Builder | 8.0 |
| Redhat | Codeready Linux Builder For Arm64 | 8.0_aarch64 |
| Redhat | Codeready Linux Builder For Arm64 Eus | 8.8_aarch64 |
| Redhat | Codeready Linux Builder For Eus | 8.8 |
| Redhat | Codeready Linux Builder For Ibm Z Systems | 8.0_s390x |
| Redhat | Codeready Linux Builder For Ibm Z Systems Eus | 8.8_s390x |
| Redhat | Codeready Linux Builder For Power Little Endian | 8.0_ppc64le |
| Redhat | Codeready Linux Builder For Power Little Endian Eus | 8.8_ppc64le |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux Eus | 9.2 |
| Redhat | Enterprise Linux For Arm 64 | 8.0 |
| Redhat | Enterprise Linux For Arm 64 Eus | 9.4_aarch64 |
| Redhat | Enterprise Linux For Ibm Z Systems | 8.0_s390x |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 8.8_s390x |
| Redhat | Enterprise Linux For Power Little Endian | 8.0_ppc64le |
| Redhat | Enterprise Linux For Power Little Endian Eus | 8.8_ppc64le |
| Redhat | Enterprise Linux Server Aus | 8.2 |
| Redhat | Enterprise Linux Server Tus | 8.4 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2025:4450Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:4451Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:4455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:4456Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:4457Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:4505Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:4532Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:7430Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:7569Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2025-3155Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2357091ExploitIssue TrackingThird Party Advisory
- http://www.openwall.com/lists/oss-security/2025/04/04/1Mailing List
- https://lists.debian.org/debian-lts-announce/2025/05/msg00036.htmlMailing List
- https://lists.debian.org/debian-lts-announce/2025/05/msg00037.htmlMailing List
- https://gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2ExploitThird Party Advisory
FAQ
What is CVE-2025-3155?
CVE-2025-3155 is a vulnerability with a CVSS score of 7.4 (HIGH). A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate...
How severe is CVE-2025-3155?
CVE-2025-3155 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-3155?
Check the references section above for vendor advisories and patch information. Affected products include: Gnome Yelp, Debian Debian Linux, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder For Arm64, Redhat Codeready Linux Builder For Arm64 Eus.