What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To check whether a Debian system is vulnerable to a known CVE, find the package and release-specific status in Debian’s Security Tracker, then compare its fixed version with the exact Debian version installed on your system. Don’t rely on an upstream version number alone: Debian may backport a security fix without changing that number in the way you expect.
Check the CVE or affected package in Debian’s Security Tracker
- Identify the issue. Note its CVE identifier, if known, or the name of the potentially affected package. A CVE’s existence does not by itself mean Debian is affected.
- Search Debian’s Security Tracker. Search by CVE or package, then select the Debian release installed on your system. Check the package’s status and any fixed version listed for that release. Debian describes the tracker as its central reference connecting CVEs with Debian packages, advisories, and bugs.
- Read the status in context. The result is specific to a package and release; do not infer your system’s status from a CVE’s general severity or from a different Debian suite. The tracker covers public information, so details under embargo may not yet appear.
Find your Debian release and installed package version
Use the package name from the tracker to inspect the installed package version. For example, if the affected package is PACKAGE, run:
As an Amazon Associate I earn from qualifying purchases.
dpkg-query -W -f='${Version}n' PACKAGE
Replace PACKAGE with the actual Debian package name. Confirm that you are comparing this version with the tracker’s fixed version for the release actually installed—not with a fixed version listed for another release.
Free tools Windows power users keep installed
One-click scans. No signup required.
Debian’s package version can differ from the upstream project’s version string. Security fixes are sometimes backported to an older-looking package version. Debian recommends checking the package changelog or comparing the exact installed version with the version stated in the relevant Debian Security Advisory (DSA). See the Debian Security FAQ for its guidance on verifying package versions.
#1 Best Overall
Use the package changelog when the version is unclear
If the installed version or tracker result leaves doubt, inspect the package changelog for an entry describing the security issue or fix. Debian’s FAQ recommends the changelog or the exact version in the DSA as ways to check whether a package is secure. The advisory and tracker status should be interpreted for your installed release and package; an upstream-looking version alone cannot confirm vulnerability.
Check installed packages with debsecan
For a broader view than one known CVE or package, Debian’s debsecan tool can report vulnerable installed packages and available updates using tracker data. It is an aid for finding candidates, not a replacement for confirming the release-specific status in the Security Tracker.
Debian’s security manual describes debsecan and its role in reporting vulnerable installed packages. Confirm findings against the tracker, especially when the release or package status is ambiguous.
Recommended Free Tools
Apply an available fix and verify the affected packages
- Refresh package lists with
sudo apt update. - Upgrade the affected package using your normal Debian package-management process, and check that the installed version now meets the fixed version listed for your release.
- If the DSA identifies a source package, check which binary packages were built from it and update the relevant installed binaries too. A source package can produce multiple binary packages.
- Restart affected services or processes when required for the updated code to take effect.
Use the DSA and package information to determine what must be updated; a single package name from a CVE search may not represent every installed binary that needs attention.
Rank #3
Account for Debian release and repository support
Debian’s Security FAQ states that stable security support lasts three years after a release. It also says that contrib, non-free, and non-free-firmware are not official parts of Debian supported by the security team. Check the installed release and where the package comes from rather than assuming every package on the system receives the same security coverage.
Manual lookup or debsecan: which should you use?
| Approach | Best suited to | What to verify |
|---|---|---|
| Security Tracker and DSA | Checking one known CVE or package against a specific Debian release | Match the installed release and exact package version to the release-specific status or fixed version. |
debsecan |
Finding potentially vulnerable packages across installed software | Confirm each important finding in the Security Tracker for the correct release. |
Both approaches depend on the right release context. Debian describes debsecan as using tracker data, so its report should guide your investigation rather than replace the release-specific reference.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why a scanner or severity score is not the final answer
A vulnerability scanner or an external severity score can help identify an issue, but it does not establish whether a particular Debian release’s package is affected or fixed. Debian says it does not provide CVSS scores or use external CVSS scores in triage. For a Debian-specific determination, check the tracker’s package, suite, notes, and fixed-version information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
