CVE-2015-1330
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force...
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
- Record
CVE-2015-1330- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
- Record
CVE-2015-1330- Updated
- 2026-11-02
EUVDEUVD-2015-1470 No score
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
- Record
EUVD-2015-1470- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w287-vj32-44rv No score
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force...
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
- Record
GHSA-w287-vj32-44rv- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
- Record
CVE-2015-1330- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1330 No score
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
- Record
DEBIAN-CVE-2015-1330- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-1330 No score
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
- Record
UBUNTU-CVE-2015-1330- Updated
- 2026-11-02
OSVUSN-2657-1 No score
unattended-upgrades vulnerability
It was discovered that unattended-upgrades incorrectly performed authentication checks in certain configurations. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages.
- Record
USN-2657-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unattended-upgradesDebian:12 |
before 0.86.1 | 0.86.1 |
unattended-upgradesDebian:13 |
before 0.86.1 | 0.86.1 |
unattended-upgradesDebian:14 |
before 0.86.1 | 0.86.1 |
unattended-upgradesDebian:6.0 |
before 0.62.2+squeeze1, plus listed versions 0.62.2 |
0.62.2+squeeze1 |
unattended-upgradesDebian:7 |
before 0.79.5+wheezy2, plus listed versions 0.79.50.79.5+wheezy1 |
0.79.5+wheezy2 |
unattended-upgradesDebian:8 |
before 0.83.3.2+deb8u1, plus listed versions 0.83.30.83.3.10.83.3.2 |
0.83.3.2+deb8u1 |
unattended-upgradesUbuntu:14.04:LTS |
before 0.82.1ubuntu2.3, plus listed versions 0.79.3ubuntu80.810.820.82.1ubuntu10.82.1ubuntu20.82.1ubuntu2.10.82.1ubuntu2.2 |
0.82.1ubuntu2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1330 is a medium vulnerability (CVSS 6.8) in Debian Unattended-upgrades, published June 29, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in unattended-upgrades 0.86.1.