-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 24 Jun 2026 16:32:05 +0200 Source: yelp Architecture: source Version: 3.38.3-1+deb11u2 Distribution: bullseye-security Urgency: medium Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org> Changed-By: Daniel Leidert <dleidert@debian.org> Closes: 1136299 Changes: yelp (3.38.3-1+deb11u2) bullseye-security; urgency=medium . * Non-maintainer upload by the Debian LTS team. * debian/patches/sandbox-escape-1-no-ghelp-proc.patch, debian/patches/sandbox-escape-2-no-external-resources.patch: Fix CVE that allows a crafted help document to read files accessible to the user and exfiltrate them to a remote server through resources loaded by the embedded web view. When yelp is launched from a sandboxed application, this also enables a sandbox escape (Closes: #1136299). Checksums-Sha1: 9a89fdd108c8ccdc3046643dd781e61e517a1bc4 2524 yelp_3.38.3-1+deb11u2.dsc 5b8c4f11e7abed2bb140dece5942b241af8ab73f 1505460 yelp_3.38.3.orig.tar.xz c52a221b2487ec79639bf69fb0b516d04496faf8 19776 yelp_3.38.3-1+deb11u2.debian.tar.xz f7297be21a92a56fbbba34243bfe258eb9d1ef04 19221 yelp_3.38.3-1+deb11u2_amd64.buildinfo Checksums-Sha256: bee32257a7593dab2ab8554d69515cf7d2a7238cd0da600d03666f47d341abab 2524 yelp_3.38.3-1+deb11u2.dsc afd46a4d0aeb46bb425c520071d818f8b2b32e69e756abfd997968769a61549d 1505460 yelp_3.38.3.orig.tar.xz b071b3c2bdde957daacb4f6fed36aa40e9d4855a6a7283d09026c38bc73b69fc 19776 yelp_3.38.3-1+deb11u2.debian.tar.xz 9344279720acf9be41333becbcc9c11639c4060a3e9652b2a326c2ba9f1f2920 19221 yelp_3.38.3-1+deb11u2_amd64.buildinfo Files: c5cf025764262ce4274bc6a7bdb786f9 2524 gnome optional yelp_3.38.3-1+deb11u2.dsc 33c319da0f332b535758a5d7b7a138ad 1505460 gnome optional yelp_3.38.3.orig.tar.xz 533fd96497e4b16e5b982c54ed7eb6d2 19776 gnome optional yelp_3.38.3-1+deb11u2.debian.tar.xz 8d640cefbe6ee94fa82cb7923cc4c94b 19221 gnome optional yelp_3.38.3-1+deb11u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmo8UUgACgkQS80FZ8KW 0F2R0A/0CVKGywtoZMDpP6FjgSQFNtPnB878eEh8bOQvFabBShih1xUWh1NwsSb7 8vdiZ0s3QDK1oSPj7aGt3rNBD8dFAl0/gGKFE/f5mDXifjRJgd3Cy4gGY5CpMM9W xFzVh37Zyl2xOdOGzDpFl/celkeIInlPw1LS2/U2JYxQVhNAEFEi2O9zuwWU48SS jJLw5/qNpyirgYua3gd5ElFUhkuC9pWFAHUstT8oz8cw40De7SrUU5VSHknvKS67 DGSs7RlMrX8GZYHAFUgJL4NnSulAzkGQXZ2AqChOVAEMKmKDA5VV5RJGufROmyCV vX9VAYkMzzgpS1Tf/LALAl+qSJDWcum554Hrn63DcnCH9Pea8u7MkUECZu68NDLC haSVod2Mo7Ho+WZtSu3mGpJBY1QDKnGkCFhquTb124Hdm88gJoMHNboeiqYhkKe1 7z2mhno523upiVxGuHsbo9EJdVPgRoHUT/T2v2L64PmKF4xAdeGpuVw1Wkdrm+6k Tc00mrBYm/vTpHivRM2TDXG3jKHxZJFTmDv+R5XYLsf2z2uIYckxuAS/4XDRo2iH UzxVfdr3tMpZFzQlCA+Jn6+WlhQGoayntvm3ogeaSCLg4VLV5AwUgTLtMFCEUETD nQ9MUVsJCDEi2wISQ+bgeICbgZ0EnH1YB4lTe+o4CBGMSagd7w== =13FO -----END PGP SIGNATURE-----
