Search the CVE ID in the Debian Security Tracker, find your release in the table, compare the fixed version with the one you have installed, and confirm with the package changelog. Debian backports fixes, so the upstream version number alone cannot tell you whether you are protected.
Step 1: know what you run
Find the installed version and the release it belongs to.
apt-cache policy package-name
cat /etc/os-release
Debian names advisories by source package, so also find the source package. Debian's security FAQ says an advisory names a source package, and that you should upgrade all binary packages built from it. You can list them on the packages.debian.org page for that source package in your release.
Step 2: look up the CVE
The FAQ points to the Debian Security Tracker at security-tracker.debian.org. Enter the CVE ID. The page lists the source package, and for each release a status and a fixed version if one exists.
Step 3: compare versions
Compare your installed version string with the fixed version for your release. If yours is equal or newer, the fix is in. If it is older, update.
sudo apt-get update
sudo apt-get install --only-upgrade package-name
The FAQ advises running apt-get update before upgrading, so the lists reflect the latest security archive.
Step 4: confirm in the changelog
apt-get changelog package-name
Debian suggests checking the changelog for the fix entry. This is the step that settles doubts about backports. Debian explains that for stable releases, instead of moving to a newer upstream release, it backports security fixes to the version shipped in the stable release. A package that looks old by upstream numbering can still contain the fix.
Reading the status
| What you see | What it usually means |
|---|---|
| A fixed version for your release | Update to at least that version |
| No fix listed, and an advisory is planned | Check the dsa-needed list the FAQ mentions |
| No advisory planned, with a note | Read the Notes section. Debian says low impact issues may be fixed in the next release, a point release, or bundled into a later advisory |
The tracker's notes explain the reasoning for each case. Do not treat "no advisory" as "not vulnerable." It can mean Debian judged the impact minor. Your own risk may differ, which is the same point made in why a Linux distro rates a CVE differently than CVSS.
Step 5: restart and verify
Fixing the package on disk is not the end. Debian's FAQ notes that some fixes need a restart and names the checkrestart tool from debian-goodies. See how to find services that need a restart after a library update.
Related reading
For the general question of judging a fix by version number, see fixed version or backported fix and check a distro backported security fix.
Try it yourself
Click into a finding and compare the installed version with the fixed version, the same comparison you make in the tracker.
Click through it at your own pace, or open it full screen.
Quick check
Why is my version older than the upstream fix but still safe?
Debian backports security fixes to the version in stable, so the package number may not change even though the fix is included.
Where do I confirm the fix landed?
In the package changelog, using apt-get changelog, as Debian's FAQ suggests.
Safeguard tracks advisories against your packages and dependencies, and its reachability analysis helps decide what to fix first. Run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
