In the GUI tool you can get a list packages with security updates. Can this be done on the command line in Debian or Ubuntu?

Normally I might use "apt-get upgrade" which would show me what is being upgraded, but I would like to know which ones are security updates.

11 Answers 11

up vote 4 down vote accepted

Use the unattended-upgrade application.

sudo unattended-upgrade

This lets you install only security updates automatically, but you can call it manually if needed.

  • I like this answer as you've actually thought about what I might be trying to do and unattended-upgrade is something I've installed today to try out. – Stephen Paulger Sep 5 '12 at 20:38
  • 9
    It doesn't actually answer the question though. – reinierpost Aug 11 '16 at 14:46
  • 2
    If this is the answer, then the question was wrong. At the least, it evolved, and should be edited accordingly and/or marked as a duplicate of… – mc0e Jun 20 '17 at 9:07
apt-get upgrade -s | grep -i security

... is what the Nagios check-apt plugin uses to count pending security updates which is similar to what you're looking for.

  • But it cannot find bash security update for shellshock? – linjunhalida Sep 28 '14 at 2:18
  • 3
    This gives false positives on packages with "security" in the name, such as "xml-security-c-utils", "debian-security-support", "modsecurity-crs", "node-security", etc. – Shnatsel Dec 16 '14 at 18:55
  • 2
    @Shnatsel for a command line check, it's very easy... you can easily see whether it's a false positive or not. Also if you know the current name of your OS, you could write grep -i xenial-security and it should reduce the false positive to pretty much zero. – Alexis Wilke Jun 27 '17 at 19:48

On ubuntu you should be able to use apt-check, it's the one that populates your motd with the number of security updates available.

  • 1
    I can't see that on debian or ubuntu. – Stephen Paulger Oct 22 '12 at 15:33
  • 5
    apt-check is in /usr/lib/update-notifier/. Try /usr/lib/update-notifier/apt-check --human-readable for a straightforward message. – u2702 Oct 18 '14 at 1:30
  • 1
    I'm not convinced that shows anything useful. To get the list, you need to add --package-names (-p), but then it doesn't seem to differentiate between regular updates and security updates. – Auspex Jul 25 '16 at 16:51

You can get a list with this command:

sudo unattended-upgrade --dry-run -d 2> /dev/null | grep 'Checking' | awk '{ print $2 }'
  • 2
    You sent ALL output to /dev/null so you won't be grepping anything! – Auspex Jul 25 '16 at 16:52
  • @Auspex thanks, fixed. – Fabrizio Regini Aug 31 '16 at 9:15
  • This seems doesn't work with trusty. it shows all packages that need update instead. – Dreaded semicolon Dec 18 '16 at 8:52
  • I guess it would show you what unattended-upgrade was going to do, and if you'd configured it to only do security updates, maybe this recipe would work. The answer though is at best woefully incomplete. – mc0e Apr 11 '17 at 14:27
  • Today I solved this need modifying a little bit apt-check. Check this gist: – Paolo Perego Oct 18 at 11:59

I have a modified version of update-notifier that takes an additional switch: --security-package-names which outputs only the security related package names. I have it as a gist (until I create a merge request in the relevant project in launchpad). Until then it can be run as follows:


curl -s \
  | python /dev/stdin --security-package-names \
  | column -t -s , \
  | sort


This gives an output of the format: package name, installed version, and candidate version:

thunderbird                          1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-gnome-support            1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-locale-en                1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1
thunderbird-locale-en-us             1:38.6.0+build1-0ubuntu0.14.04.1     1:38.8.0+build1-0ubuntu0.14.04.1

Based on Fabrizio Regini's answer above.

For 12.04 / Precise:

sudo unattended-upgrade --dry-run -d 2>&1 /dev/null | grep 'Checking' | grep security | awk '{ print $2 }'

For 14.04 /Trusty:

sudo unattended-upgrade --dry-run -d | grep 'Checking' | grep security | awk '{ print $2 }'

And a variant clobbered together after reading the other responses - I believe this to cater to the false positive issue, and be reasonably lightweight.

sudo unattended-upgrade --dry-run -d 2>/dev/null  | awk '/Checking/ && /archive:..*-security. / {print $2}'

I believe that Answering the question the OP asks is how to see the List of packages, and not how to install only security packages. Building on the answer of @topdog You should use: /usr/lib/update-notifier/apt-check -p Where the -p flag stands for packages

  • 1
    this lists all packages and not only security updates – confiq Jul 14 '15 at 14:11
  • apt-check seems unavailable in Debian Jessie. It remains on updated Wheezy-systems but fresh installs don't have the update-notifier-common anymore. Do you know an alternative? – jan Jan 27 '16 at 17:45
  • @jan it's still there, as part of update-notifier-common – Auspex Jul 25 '16 at 16:56
  • @Auspex That package does no longer exist in Jessie. There is only update-notifier which is an outdated transitional package for gnome-packagekit. See here. – jan Jul 26 '16 at 14:07
  • 1
    @jan Sorry, I took debian's word for it. I searched for the file,… and it told me You have searched for files named apt-check in suite jessie, all sections, and all architectures. Found 1 results., but then when you actually click on the link for that result, it tells you Package not available in this suite. – Auspex Jul 27 '16 at 13:35

These two commands will spit out the list. Pipe to wc -l to see how many are behind. ;-)

grep security /etc/apt/sources.list > /tmp/security.list
sudo apt-get upgrade -oDir::Etc::Sourcelist=/tmp/security.list -s

Still valid for older distros or if you have update repos off, but security on:

sudo apt-get upgrade -s| grep ^Inst |grep Security 
  • Be careful. If you generate /tmp/security.list this way while running as root, then you are vulnerable to a symlink based attack. – mc0e Apr 23 '17 at 12:36
  • I can't get this approach (the first code block) on Ubuntu 14.04. The -oDir::Etc::Sourcelist option doesn't seem to disable the standard set of repositories. – mc0e Apr 23 '17 at 13:52

I think @smin 's answer is basically a good approach, but a bit loose with the regex, as noted by @Shnatsel.

How about this:

apt-get upgrade -q --dry-run \
| perl -ne 'm/^Inst (\S+) \S+ \(([^\)]+) Debian-Security:8/ && print "$1-$2\n"'

This lists the package names along with the versions you want to install. You can take -$2 out of the print statement if you don't want the versions there.

[This could probably be made just a little lighter-weight by using awk instead of perl]

I solved modifying the apt-check script on my Ubuntu system. It takes care only about security updates, displaying also package names if -p flag it has been provided.

You can find the gist here:

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.