Canonical Ubuntu vulnerabilities

5 vulnerabilities

Known vulnerabilities in Canonical Ubuntu, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.1CVE-2025-14551canonicalubuntu+3
EPSS score
0.28%
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.9.1CVE-2025-15480canonicalubuntu+1
EPSS score
0.31%
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.6.4CVE-2014-1424canonicalubuntu+2
EPSS score
1.57%
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."7.2CVE-2014-1949chainguardgtk-2.0+8
EPSS score
0.33%
GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.8.8CVE-2026-10037canonicalubuntu+11
EPSS score
0.18%
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.