CVE-2025-15480

EUVD-2025-209377
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.51%
Affected Products (NVD)
VendorProductVersion
canonicalubuntu_desktop_provision
24.04.4
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
subiquity
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
dne
questing
dne
Common Weakness Enumeration
References
https://github.com/canonical/ubuntu-desktop-provision/pull/1399
https://github.com/canonical/ubuntu-desktop-provision/pull/1400