I'm a security minded person, normally I want to make sure most of the software packages that I use in my operating system stays secure.

Now, suppose there is a package called "sunshine" installed in my system(through apt of course), and have a vulnerable version 8.70, the ubuntu security advisory tells me 9.10 is the last version vulnerable, but after I do apt-get install --only-upgrade, I still have "sunshine" at a vulnerable version number ( below 9.10 ).

This is pretty insecure, right? I found this post which says they don't update newer version of software on system's repository after a version of Ubuntu was officially released. However, that post was old, is this still true?


As you read it already, packages after being released, will be put on frozen state, however you still get update for that package in form of bug fixes and security patches, means Ubuntu team will patch the issues of that package without the need of upgrading it to the last version, you can use:

apt changelog pkg-name

to see what has been done in the last update, for example here is the change log of samba:

samba (2:4.3.11+dfsg-0ubuntu0.16.04.9) xenial-security; urgency=medium

  * SECURITY UPDATE: KDC-REP service name impersonation
    - debian/patches/CVE-2017-11103.patch: use encrypted service
      name rather than unencrypted (and therefore spoofable) version
      in heimdal
    - CVE-2017-11103

If you inspect the logs closely you'll see their at the same version however a lot of things is being done, pay attention to SECURITY UPDATE and CVE line.

  • you mean ubuntu team is fixing all those vulnerabilities on their own? that is awesome, albeit a very heavy task to my understanding. – Sajuuk Jul 31 '17 at 9:32
  • Yeah, that's right... – Ravexina Jul 31 '17 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.