How to only install security updates on debian

Question

Because of the Shell Shock bug I need to make updates on some of our machines.
But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure if there are any dependencies.

Our system administrator is not here yet and we cannot contact him.
So my question is, how can I only apt-get upgrade the security updates, without having to update everything to the newest available version in debian stable?

EDIT SOLUTION
apt-get install --only-upgrade bash did the thing for me.
On one of our servers, there was still just Debian Squeeze installed.
Changing squeeze to wheezy in /etc/apt/sources.list and then running:
- apt-get update
- apt-get install --only-upgrade bash
installed the fixed bash into this older squeeze system.

Answer 1

For Squeeze use squeeze-lts if possible! (i386 and amd64 only...)

append this to your sources.list:

deb http://http.debian.net/debian squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian squeeze-lts main contrib non-free

and then run

apt-get update
apt-get install -t squeeze-lts --only-upgrade bash

Here is more detail on squeeze-lts: https://wiki.debian.org/LTS/Using

If you really want to patch debian lenny check out this gist (but rather consider updating to a newer distro!)

Answer 2

You can use:

apt-get install --only-upgrade <package>

If is installed, this will upgrade only the specified package.

Answer 3

Ubuntu 12.04 “Precise” and 14.04 “Trusty”, Debian 7 “Wheezy”

apt-get update; apt-get install bash

---

Debian 6 “Squeeze”

/etc/apt/sources.list.d/squeezelts.list

deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free

/etc/apt/apt.conf.d/50squeezelts

APT::Default-Release "squeeze-lts";

Then run the update:

apt-get update; apt-get install bash

---

Patching older and unsupported systems as Lenny

# Retrieve and install dependencies first
apt-get update && apt-get install build-essential gettext bison

# Get bash 3.2 source
wget http://ftp.gnu.org/gnu/bash/bash-3.2.tar.gz
tar zxvf bash-3.2.tar.gz
cd bash-3.2

# Download and apply all patches
# Includes patches for CVE-2014-6271 (52) *AND* CVE-2014-7169 (53) *AND* Florian Weimer patch (54)
for i in $(seq -f "%03g" 1 54); do
    wget -nv http://ftp.gnu.org/gnu/bash/bash-3.2-patches/bash32-$i
    patch -p0 < bash32-$i
done

# Compile and install to /usr/local/bin/bash
./configure && make
make install

# Point /bin/bash to the new binary
mv /bin/bash /bin/bash.old
ln -s /usr/local/bin/bash /bin/bash

Answer 4

add this to your sources list:

deb http://ftp.de.debian.org/debian sid main

apt-get update apt-get install --only-upgrade bash