diff -Nru unattended-upgrades-0.83.6/debian/changelog unattended-upgrades-0.83.6ubuntu1/debian/changelog
--- unattended-upgrades-0.83.6/debian/changelog	2015-03-05 17:36:33.000000000 +0100
+++ unattended-upgrades-0.83.6ubuntu1/debian/changelog	2015-06-19 15:00:38.000000000 +0200
@@ -1,3 +1,11 @@
+unattended-upgrades (0.83.6ubuntu1) vivid-security; urgency=medium
+
+  * fix missing package authentication check for apt
+    configurations that force-{confold,confnew} (CVE-2015-1330)
+    LP: #1466380
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 19 Jun 2015 15:00:24 +0200
+
 unattended-upgrades (0.83.6) unstable; urgency=medium
 
   [ Brian Murray ]
diff -Nru unattended-upgrades-0.83.6/test/unattended_upgrade.py unattended-upgrades-0.83.6ubuntu1/test/unattended_upgrade.py
--- unattended-upgrades-0.83.6/test/unattended_upgrade.py	2015-03-05 17:36:33.000000000 +0100
+++ unattended-upgrades-0.83.6ubuntu1/test/unattended_upgrade.py	2015-06-19 15:01:00.000000000 +0200
@@ -527,6 +527,11 @@
             logging.debug("pkg '%s' now marked delete" % pkg.name)
             return False
         if pkg.marked_install or pkg.marked_upgrade:
+            # apt will never fallback from a trusted to a untrusted
+            # origin so its good enough if we have a single trusted one
+            if not any([o.trusted for o in pkg.candidate.origins]):
+                logging.debug("pkg '%s' is untrusted" % pkg.name)
+                return False
             if not is_allowed_origin(pkg.candidate, allowed_origins):
                 logging.debug("pkg '%s' not in allowed origin" % pkg.name)
                 return False
diff -Nru unattended-upgrades-0.83.6/unattended-upgrade unattended-upgrades-0.83.6ubuntu1/unattended-upgrade
--- unattended-upgrades-0.83.6/unattended-upgrade	2015-03-05 17:36:33.000000000 +0100
+++ unattended-upgrades-0.83.6ubuntu1/unattended-upgrade	2015-06-19 15:01:00.000000000 +0200
@@ -527,6 +527,11 @@
             logging.debug("pkg '%s' now marked delete" % pkg.name)
             return False
         if pkg.marked_install or pkg.marked_upgrade:
+            # apt will never fallback from a trusted to a untrusted
+            # origin so its good enough if we have a single trusted one
+            if not any([o.trusted for o in pkg.candidate.origins]):
+                logging.debug("pkg '%s' is untrusted" % pkg.name)
+                return False
             if not is_allowed_origin(pkg.candidate, allowed_origins):
                 logging.debug("pkg '%s' not in allowed origin" % pkg.name)
                 return False