In the GUI tool you can get a list packages with security updates. Can this be done on the command line in Debian or Ubuntu?

Normally I might use "apt-get upgrade" which would show me what is being upgraded, but I would like to know which ones are security updates.

  • just for Ubuntu 14.04, 16.04 and 18.04 LTS: askubuntu.com/a/1128270/92504
    – Angel
    Mar 24, 2019 at 12:13
  • Such a simple and frequent task and not a single functional (out of the box, at least) or standard way of doing it... Yay! Linux is amazing! Not.
    – NoOne
    Sep 26, 2020 at 11:46

11 Answers 11


Use the unattended-upgrade application.

sudo unattended-upgrade

This lets you install only security updates automatically, but you can call it manually if needed.

  • I like this answer as you've actually thought about what I might be trying to do and unattended-upgrade is something I've installed today to try out. Sep 5, 2012 at 20:38
  • 23
    It doesn't actually answer the question though. Aug 11, 2016 at 14:46
  • 5
    If this is the answer, then the question was wrong. At the least, it evolved, and should be edited accordingly and/or marked as a duplicate of askubuntu.com/questions/194/…
    – mc0e
    Jun 20, 2017 at 9:07
  • My Debian apt repository only lists a unattended-upgrades (plural) package. Was that package renamed or what?
    – NoOne
    Dec 11, 2021 at 11:24
  • Ah! The package name is in plural and calling it is in singular... Weird.
    – NoOne
    Dec 11, 2021 at 11:34
apt-get upgrade -s | grep -i security

... is what the Nagios check-apt plugin uses to count pending security updates which is similar to what you're looking for.

  • 1
    But it cannot find bash security update for shellshock? Sep 28, 2014 at 2:18
  • 6
    This gives false positives on packages with "security" in the name, such as "xml-security-c-utils", "debian-security-support", "modsecurity-crs", "node-security", etc.
    – Shnatsel
    Dec 16, 2014 at 18:55
  • 2
    @Shnatsel for a command line check, it's very easy... you can easily see whether it's a false positive or not. Also if you know the current name of your OS, you could write grep -i xenial-security and it should reduce the false positive to pretty much zero. Jun 27, 2017 at 19:48
  • 2
    @Shnatsel so grep Debian-Security would be a better solution?
    – Pablo A
    Jan 28, 2019 at 15:59
  • This is useful for getting the number of regular;security updates available. The -p option to list the package names available for update does not distinguish between regular and security updates however (at least on 16.04)...so this is not a viable way to get a list of security updates available as far as I can tell.
    – mattpr
    Feb 27, 2019 at 8:31

On ubuntu you should be able to use apt-check, it's the one that populates your motd with the number of security updates available.

  • 2
    I can't see that on debian or ubuntu. Oct 22, 2012 at 15:33
  • 6
    apt-check is in /usr/lib/update-notifier/. Try /usr/lib/update-notifier/apt-check --human-readable for a straightforward message.
    – u2702
    Oct 18, 2014 at 1:30
  • 2
    I'm not convinced that shows anything useful. To get the list, you need to add --package-names (-p), but then it doesn't seem to differentiate between regular updates and security updates.
    – Auspex
    Jul 25, 2016 at 16:51

You can get a list with this command:

sudo unattended-upgrade --dry-run -d 2> /dev/null | grep 'Checking' | awk '{ print $2 }'
  • 2
    You sent ALL output to /dev/null so you won't be grepping anything!
    – Auspex
    Jul 25, 2016 at 16:52
  • This seems doesn't work with trusty. it shows all packages that need update instead. Dec 18, 2016 at 8:52
  • I guess it would show you what unattended-upgrade was going to do, and if you'd configured it to only do security updates, maybe this recipe would work. The answer though is at best woefully incomplete.
    – mc0e
    Apr 11, 2017 at 14:27
  • Today I solved this need modifying a little bit apt-check. Check this gist: gist.github.com/thesp0nge/94f9d336a081a3fefba6ca61d787a28b Oct 18, 2018 at 11:59

I have a modified version of update-notifier that takes an additional switch: --security-package-names which outputs only the security related package names. I have it as a gist (until I create a merge request in the relevant project in launchpad). Until then it can be run as follows:


curl -s https://gist.githubusercontent.com/ahmadnazir/c2444d6b09fd7bb4963a13bc577d92a3/raw/0231b94a4e46abe0a5959de5f84feda76ad2eb9d/apt-check.py \
  | python /dev/stdin --security-package-names \
  | column -t -s , \
  | sort


This gives an output of the format: package name, installed version, and candidate version:

thunderbird                          1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-gnome-support            1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-locale-en                1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-locale-en-us             1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1

Based on Fabrizio Regini's answer above.

For 12.04 / Precise:

sudo unattended-upgrade --dry-run -d 2>&1 /dev/null | grep 'Checking' | grep security | awk '{ print $2 }'

For 14.04 /Trusty:

sudo unattended-upgrade --dry-run -d | grep 'Checking' | grep security | awk '{ print $2 }'

And a variant clobbered together after reading the other responses - I believe this to cater to the false positive issue, and be reasonably lightweight.

sudo unattended-upgrade --dry-run -d 2>/dev/null  | awk '/Checking/ && /archive:..*-security. / {print $2}'

I believe that Answering the question the OP asks is how to see the List of packages, and not how to install only security packages. Building on the answer of @topdog You should use: /usr/lib/update-notifier/apt-check -p Where the -p flag stands for packages

  • 1
    this lists all packages and not only security updates
    – confiq
    Jul 14, 2015 at 14:11
  • apt-check seems unavailable in Debian Jessie. It remains on updated Wheezy-systems but fresh installs don't have the update-notifier-common anymore. Do you know an alternative?
    – jan
    Jan 27, 2016 at 17:45
  • @jan it's still there, as part of update-notifier-common
    – Auspex
    Jul 25, 2016 at 16:56
  • @Auspex That package does no longer exist in Jessie. There is only update-notifier which is an outdated transitional package for gnome-packagekit. See here.
    – jan
    Jul 26, 2016 at 14:07
  • 1
    @jan Sorry, I took debian's word for it. I searched for the file, packages.debian.org/… and it told me You have searched for files named apt-check in suite jessie, all sections, and all architectures. Found 1 results., but then when you actually click on the link for that result, it tells you Package not available in this suite.
    – Auspex
    Jul 27, 2016 at 13:35

These two commands will spit out the list. Pipe to wc -l to see how many are behind. ;-)

grep security /etc/apt/sources.list > /tmp/security.list
sudo apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -s

Still valid for older distros or if you have update repos off, but security on:

sudo apt-get upgrade -s| grep ^Inst |grep Security 
  • 1
    Be careful. If you generate /tmp/security.list this way while running as root, then you are vulnerable to a symlink based attack.
    – mc0e
    Apr 23, 2017 at 12:36
  • I can't get this approach (the first code block) on Ubuntu 14.04. The -oDir::Etc::Sourcelist option doesn't seem to disable the standard set of repositories.
    – mc0e
    Apr 23, 2017 at 13:52

I think @smin 's answer is basically a good approach, but a bit loose with the regex, as noted by @Shnatsel.

How about this:

apt-get upgrade -q --dry-run \
| perl -ne 'm/^Inst (\S+) \S+ \(([^\)]+) Debian-Security:8/ && print "$1-$2\n"'

This lists the package names along with the versions you want to install. You can take -$2 out of the print statement if you don't want the versions there.

[This could probably be made just a little lighter-weight by using awk instead of perl]


I solved modifying the apt-check script on my Ubuntu system. It takes care only about security updates, displaying also package names if -p flag it has been provided.

You can find the gist here: https://gist.github.com/thesp0nge/94f9d336a081a3fefba6ca61d787a28b

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.