I'm currently running debian 8 and I want to upgrade security patches which is provided by debian but problem is that, if I upgrade a single package then it asks to upgrade many packages, as in:

$ apt-get upgrade openssl

The following packages will be upgraded:
dpkg dpkg-dev krb5-locales libapache2-mod-php5 libdpkg-perl libfreetype6      libgdk-pixbuf2.0-0 libgdk-pixbuf2.0-common libgssapi-krb5-2
libk5crypto3 libkrb5-3 libkrb5support0 libpng12-0 libssl1.0.0 linux-headers-3.2.0-4-amd64 linux-headers-3.2.0-4-common
linux-image-3.2.0-4-amd64 linux-libc-dev ntp php5 php5-cli php5-common php5-   curl php5-readline tzdata unzip virtualbox virtualbox-dkms
virtualbox-qt....too many

The following packages have been kept back:
acpid anacron apt-xapian-index aptitude aptitude-common aspell-de at at- spi2-core avahi-daemon base-passwd bind9-host binfmt-support
bsdutils consolekit cron cryptsetup-bin db5.1-util dbus default-jre default- jre-headless dictionaries-common dmsetup dnsmasq-base
dnsutils dovecot-core dovecot-imapd dovecot-pop3d duplicity fakeroot gdebi- core gettext gir1.2-accountsservice-1.0 gir1.2-atspi-2.0
gir1.2-folks-0.6 gir1.2-gck-1 gir1 ....too many

How to skip the above packages?

  • 3
    If you're running Debian 8 you should really upgrade all those other packages too; the stable distribution has very strict conditions for updates, so if a package upgrade is available there's generally a very good reason for it. Dec 16, 2015 at 9:29

3 Answers 3


You have to use:

sudo apt-get --only-upgrade install openssl

this will upgrade only openssl package and, eventually, the dependencies.

  • I execute this command: Reading package lists... Done Building dependency tree Reading state information... Done openssl is already the newest version. 0 upgraded, 0 newly installed, 0 to remove and 32 not upgraded. Dec 16, 2015 at 9:18
  • If you want to upgrade the OpenSSL packages, you're looking for libssl1.0.0: sudo apt-get --only-upgrade install libssl1.0.0. Dec 16, 2015 at 9:30
  • You can check versions with apt-cache policy opnessl libssl1.0.0
    – paul
    Dec 16, 2015 at 9:43
  • I check current version of OpenSSL 1.0.1e 11 Feb 2013 after the upgrading above command. Dec 17, 2015 at 5:02
  • 1
    The problem with this is that it also marks the package as being manually installed. I know I can reset it with apt-mark, but I do wonder if there's a way to avoid that little extra trouble.
    – Dolda2000
    Feb 11, 2018 at 13:39

The problem you're having is that apt-get upgrade upgrades all packages installed on your system. The extra package name you're specifying is not used.

You should use apt-get install openssl if you only want to upgrade that one package. Some other packages may be upgraded at the same time if the new version of the specified package depends on newer versions of those other packages.

  • problem is that, it's too many dependency of openssl like kernel, php, mysql, ever virtual box, many libs and it's effect to many existing applications. total download site is more then 400mb, please give my option. Dec 17, 2015 at 4:47

Install aptitude. Use its intuitive UI to make individual actions. That helps you to find the correct balance if you certainly need to break some dependency or downgrade some of the packages.

For example, if you mark that package for removal, it can list all the packages that get affected, and there you can browse through (using comma and period) all the automatic suggestions, including the one for upgrading just that one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .