To track and mitigate security vulnerabilities in Debian, I am using the
debsecan utility. The list of high rated remote code execution vulnerabilities can be found using:
debsecan | grep "remotely exploitable, high urgency"
To limit the list to vulnerabilities for which a fix is available we can use this command:
debsecan --suite stretch --only-fixed
To keep the system more secure we can upgrade the vulnerable packages and remove any unnecessary vulnerable packages (
apt list --installed | grep xx) such as
To make this task more easy for daily use when the
debsecan database is updated and a new package is installed on my system, how can I get only the list of the installed packages which are vulnerable to remote attack?