GNOME

A critical vulnerability in GNOME's Yelp help viewer identified as CVE-2025-3155 has led to a security breach enabling attackers to exfiltrate SSH keys and sensitive files from Ubuntu systems. The exploit takes advantage of improper handling of ghelp:// URI scheme and XML processing. The vulnerability, with a moderate CVSS score of 6.5, requires user interaction to trigger the attack, making social engineering a viable threat. The potential impact includes theft of credentials and sensitive information that could be used for lateral movement within networks. System administrators must stay vigilant by educating users and monitoring endpoints until an official patch is released.

Source: https://cybersecuritynews.com/poc-exploit-yelp-flaw-ssh-keys/

TPRM report: https://scoringcyber.rankiteo.com/company/gnome-games

"id": "gno007040925",
"linkid": "gnome-games",
"type": "Vulnerability",
"date": "4/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Software',
                        'name': 'GNOME',
                        'type': 'Organization'}],
 'attack_vector': 'Improper handling of ghelp:// URI scheme and XML processing',
 'data_breach': {'data_exfiltration': ['SSH keys', 'Sensitive files'],
                 'type_of_data_compromised': ['SSH keys', 'Sensitive files']},
 'description': "A critical vulnerability in GNOME's Yelp help viewer "
                'identified as CVE-2025-3155 has led to a security breach '
                'enabling attackers to exfiltrate SSH keys and sensitive files '
                'from Ubuntu systems. The exploit takes advantage of improper '
                'handling of ghelp:// URI scheme and XML processing. The '
                'vulnerability, with a moderate CVSS score of 6.5, requires '
                'user interaction to trigger the attack, making social '
                'engineering a viable threat. The potential impact includes '
                'theft of credentials and sensitive information that could be '
                'used for lateral movement within networks. System '
                'administrators must stay vigilant by educating users and '
                'monitoring endpoints until an official patch is released.',
 'impact': {'data_compromised': ['SSH keys', 'Sensitive files'],
            'systems_affected': ['Ubuntu systems']},
 'motivation': ['Theft of credentials', 'Theft of sensitive information'],
 'post_incident_analysis': {'root_causes': ['Improper handling of ghelp:// URI '
                                            'scheme',
                                            'XML processing']},
 'recommendations': ['Stay vigilant', 'Monitor endpoints', 'Educate users'],
 'response': {'remediation_measures': ['Educating users',
                                       'Monitoring endpoints']},
 'title': "CVE-2025-3155 Exploit in GNOME's Yelp Help Viewer",
 'type': 'Vulnerability Exploit',
 'vulnerability_exploited': 'CVE-2025-3155'}