To track and mitigate security vulnerabilities in Debian, I am using the debsecan utility. The list of high rated remote code execution vulnerabilities can be found using:

debsecan | grep "remotely exploitable, high urgency"

To limit the list to vulnerabilities for which a fix is available we can use this command:

debsecan --suite stretch --only-fixed

To keep the system more secure we can upgrade the vulnerable packages and remove any unnecessary vulnerable packages (apt list --installed | grep xx) such as vlc, thunderbird ...

To make this task more easy for daily use when the debsecan database is updated and a new package is installed on my system, how can I get only the list of the installed packages which are vulnerable to remote attack?


debsecan checks installed packages by default, so all you need to do is filter its output (since it lists all the vulnerabilities affecting installed packages, which means it often lists multiple vulnerabilities per package):

debsecan | awk '/remotely exploitable/ { vuln[$2]++ } END { for (package in vuln) print package }' | sort

To get better results, you should specify the suite of course.

You can also use debsecan-create-cron to create a cron job which will email you a report every day.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.