Yelp (GNOME Help) arbitrary file read via Mallard XInclude + SVG JavaScript

#!/usr/bin/env bash
# noisgate verification: CVE-2025-3155 (Yelp arbitrary file read)
# Patched in upstream yelp 42.3 / yelp-xsl 42.3 (or distro-backported equivalents).
set -u

VULN=1; PATCHED=0; UNKNOWN=2

# Step 1: is Yelp even installed?
if ! command -v yelp >/dev/null 2>&1; then
  # Could still be installed without being on PATH; check pkg DB
  if ! (dpkg -s yelp >/dev/null 2>&1 || rpm -q yelp >/dev/null 2>&1); then
    echo "NOT_INSTALLED (yelp absent — not vulnerable)"
    exit $PATCHED
  fi
fi

# Step 2: read installed version per package manager
get_ver() {
  local pkg="$1"
  if command -v dpkg-query >/dev/null 2>&1; then
    dpkg-query -W -f='${Version}\n' "$pkg" 2>/dev/null | head -n1
  elif command -v rpm >/dev/null 2>&1; then
    rpm -q --qf '%{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null | head -n1
  fi
}

YELP_VER=$(get_ver yelp)
XSL_VER=$(get_ver yelp-xsl)

if [ -z "$YELP_VER" ] && [ -z "$XSL_VER" ]; then
  echo "UNKNOWN (could not determine yelp / yelp-xsl version)"
  exit $UNKNOWN
fi

# Step 3: compare. Upstream fix is 42.3. Distro backports advertise the same
# upstream version OR carry a patched suffix (e.g. RHEL: 42.1-2.el9_5).
# Strategy: if upstream >= 42.3, PATCHED. If upstream < 42.3, check for known
# backport release markers from RHEL/Ubuntu/Fedora advisories.

ver_ge() {
  # returns 0 if $1 >= $2 (semver-ish)
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

check_one() {
  local name="$1" ver="$2"
  [ -z "$ver" ] && return 0   # not installed, skip
  local base=${ver%%-*}
  if ver_ge "$base" "42.3"; then
    echo "  $name $ver  -> upstream patched"
    return 0
  fi
  # Backport detection: distro advisories
  case "$ver" in
    *el9_5*|*el9_6*|*el10*) echo "  $name $ver  -> RHEL backport (RHSA-2025:4505)"; return 0;;
    *ubuntu*22.04*|*ubuntu*24.04*) 
      # Ubuntu USN-published versions carry +deb/ubuntu suffix; manual sub-check needed.
      echo "  $name $ver  -> AMBIGUOUS Ubuntu version, verify against USN"; return 2;;
    *fc42*|*fc41*) echo "  $name $ver  -> Fedora backport (FEDORA-2025-e788608959)"; return 0;;
  esac
  echo "  $name $ver  -> < 42.3 and no backport marker"
  return 1
}

rc1=0; rc2=0
check_one yelp "$YELP_VER"; rc1=$?
check_one yelp-xsl "$XSL_VER"; rc2=$?

if [ $rc1 -eq 1 ] || [ $rc2 -eq 1 ]; then
  echo "VULNERABLE (CVE-2025-3155): upgrade to yelp/yelp-xsl >= 42.3 or distro backport"
  exit $VULN
fi

if [ $rc1 -eq 2 ] || [ $rc2 -eq 2 ]; then
  echo "UNKNOWN: ambiguous version, cross-check against vendor advisory"
  exit $UNKNOWN
fi

echo "PATCHED (CVE-2025-3155)"
exit $PATCHED