What is a security update?
The difference between an outdated package and a vulnerable one, what a CVE is, and why most Linux updates aren't security fixes.
Outdated isn't the same as vulnerable
A Linux machine almost always has some packages with a newer version available. Most of those updates are routine: bug fixes, small improvements, new upstream releases. They're worth installing eventually, but nothing bad happens if they wait a while.
A security update is different. It fixes a known vulnerability - a flaw that someone could use to read data they shouldn't, crash a service, or run their own code on the machine. Once a fix is public, so is the information about what it fixes, and that makes unpatched machines easier targets over time.
That's why OS Checker reports the two separately: a package is outdated when an update is available, and vulnerable when that update fixes a known vulnerability. A list of 40 outdated packages and a list of 2 vulnerable ones call for very different reactions.
What a CVE is
Most publicly known vulnerabilities get a CVE identifier, like CVE-2024-3094. CVE stands for Common Vulnerabilities and Exposures, and the identifier is simply a shared name for one specific flaw, so that upstream developers, distributions, security tools and administrators can all refer to the same thing.
One update can fix several CVEs at once, and one CVE can affect many packages and distributions. A distribution's security advisory ties them together: which CVEs are fixed, in which package, and in which version.
Why the version number can look unchanged
Stable distributions like Debian, Ubuntu, Rocky Linux and AlmaLinux rarely move a package to a new upstream version in the middle of a release, since that could change behavior people depend on. Instead, the security team takes just the fix and applies it to the version already in the release. This is called backporting.
So a fixed OpenSSL on a stable release may still report the same upstream version as before, with only the distribution's own suffix changing. It also means that comparing your version numbers against the newest upstream release says little about whether you're vulnerable - what matters is whether your distribution has published a fix for your release, and whether you've installed it.
Where to look for them
Every major distribution publishes its security updates somewhere: Debian and Ubuntu as security advisories and notices, Rocky Linux and AlmaLinux as errata, Arch in its security tracker. See Linux support and end-of-life dates for how it works on each one.
On a single machine, the package manager can usually tell you which pending updates are security fixes. Across many machines and several distributions, that's exactly the overview that's hard to keep - which is what OS Checker is for.