USN-7447-1: Yelp vulnerability

Releases

• Ubuntu 25.04
• Ubuntu 24.10
• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• yelp - Help browser for GNOME
• yelp-xsl - XSL stylesheets for the yelp help browser

Details

It was discovered that Yelp incorrectly handled paths in ghelp URLs. A
remote attacker could use this issue to trick users into opening malicious
downloaded help files and exfiltrate sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 25.04

• yelp - 42.2-2ubuntu0.1
• yelp-xsl - 42.1-3ubuntu0.1

Ubuntu 24.10

• yelp - 42.2-1ubuntu0.24.10.1
• yelp-xsl - 42.1-2ubuntu0.24.10.1

Ubuntu 24.04

• yelp - 42.2-1ubuntu0.24.04.1
• yelp-xsl - 42.1-2ubuntu0.24.04.1

Ubuntu 22.04

• yelp - 42.1-1ubuntu0.1
• yelp-xsl - 42.0-1ubuntu0.1

Ubuntu 20.04

• yelp - 3.36.2-0ubuntu1.1
• yelp-xsl - 3.36.0-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2025-3155