As a non-professional in the area of Linux security, let me share what I figured out while patching Ubuntu 12.04 servers for GHOST. In my situation at least, I

As a non-professional in the area of Linux security, let me share what I figured out while patching Ubuntu 12.04 servers for GHOST. In my situation at least, I got confused by looking for glibc and eglibc, which are listed as packages to be patched in http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-0235.html http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20.... I wanted to know what version of glibc and eglibc my servers were running so that I could check that they were getting updated. Running dpkg -s glibc and dpkg -s eglibc turned up nothing. How could that be since there had to be a C library?! Answer: there are indeed compiled C libraries on my servers. I found that the key packages to update were related to libc6 (http://packages.ubuntu.com/precise/libc6 http://packages.ubuntu.com/precise/libc6), which were compiled from eglibc. At any rate, I patched my servers with a typical procedure: sudo apt-get update sudo unattended-upgrades BTW, it helped me to understand that Ubuntu 12.04 uses eglibc and not glibc: http://askubuntu.com/questions/372864/why-ubuntu-uses-eglibc-instead-of-glibc/372880#372880 http://askubuntu.com/questions/372864/why-ubuntu-uses-eglibc... to make sense of the charts at http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-0235.html http://people.canonical.com/~ubuntu-security/cve/2015/CVE-20..., especially the reason for the "DNE" (does not exist?) for Ubuntu 12.04 and glibc. Hope this is clarifying to someone out there. Would love to hear confirmation or refutation of my reasoning here.