The other answers given here do not all list the same security upgrades.
Ubuntu has two standard policies for upgrading packages: apt-get upgrade
is more conservative than apt-get dist-upgrade
. The latter will generally upgrade more packages, and it may contain security upgrades that the former ignores.
The notification shown (by default) upon login is a cached copy of the output of apt-check
:
$ /usr/lib/update-notifier/apt-check --human-readable
92 packages can be updated.
3 updates are security updates.
These numbers count packages that will be upgraded by apt-get dist-upgrade
; you can list these security upgrades as follows:
sudo apt-get --no-download -s dist-upgrade -V | awk '/^Inst.*security/ {print $2}'
or
apt-get -s dist-upgrade -V | awk '/^Inst.*security/ {print $2}'
To see just the security upgrades in an apt-get upgrade
, do
apt-get -s upgrade -V | awk '/^Inst.*security/ {print $2}'
or
apt list --upgradable
By default, unattended-upgrades
only runs an upgrade
, not dist-upgrade
.
This explains why unattended-upgrades
, even when configured to automatically install security upgrades, doesn't always install all security upgrades reported by apt-check
.
All of these tools use the local package index - so to check the status on the Ubuntu mirror your host is using, first update it with sudo apt update
.
A mirror can be out of date in principle, so if you want to check at the source, you need to check on Launchpad - at least for packages distributed by Ubuntu.