CVE-2025-15480

CRITICAL9.1

Senstive information disclosure was affecting ubuntu-desktop-provision

Published Apr 9, 2026

Modified 1 months ago

Details

In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.

References

FIX

https://github.com/canonical/ubuntu-desktop-provision/pull/1399

FIX

https://github.com/canonical/ubuntu-desktop-provision/pull/1400

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-15480

CVSS Analysis

CVSS v4.0

2.7

Exploitability

Attack Vector