unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are…

published 2015-07-01 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-1470

cvss: 6.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 73%
public exploits: 0; none known

unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.

Patch / fix

distros 2

debian ubuntu

unattended-upgrades Debian 14, Debian 13, Debian 12 0.86.1

debian advisories DEBIAN-CVE-2015-1330

unattended-upgrades Ubuntu 14.04 LTS 0.82.1ubuntu2.3

ubuntu advisories UBUNTU-CVE-2015-1330

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

1.44% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-287 Improper Authentication

References

debian.org /security/2015/dsa-3297
vendor-advisory
ubuntu.com /usn/USN-2657-1
vendor-advisory
metadata.ftp-master.debian.org /changelogs//main/u/unattended-upgrades/unattended-upgrades_0.86.1_changelog
securitytracker.com /id/1032738
vdb-entry

Sources

CVE List CVE-2015-1330
NVD CVE-2015-1330

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary