CVE-2025-15480lowCWE-1258

CVE-2025-15480: low-severity vulnerability in Canonical Ubuntu

Senstive information disclosure was affecting ubuntu-desktop-provision

Published · Updated

Follow this CVE+ Monitor Ubuntu

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.7epss 0.3%
In short

Ubuntu's desktop setup tool could accidentally include user password hashes in crash logs sent to bug reports. This means your password information might be exposed if the installation fails and you report the problem.

Technical detail

Ubuntu-desktop-provision 24.04.4 suffers from sensitive information disclosure (CWE-1258) where user password hashes are inadvertently included in crash logs submitted to Launchpad during installation failures. The vulnerability requires user interaction (bug report submission) and affects the confidentiality of authentication credentials that could be used for offline attacks.

Summary generated and translated by AI from the official description.
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U
Affected products
Canonical · Ubuntu
Related CVEs — Canonical Ubuntu

In the same product, most dangerous first.

CVE-2025-14551LOWSenstive information disclosure was affecting subiquityEPSS 0.3%CVE-2026-10037HIGHSandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portalEPSS 0.2%