Libs are always a pain to patch at the OS level, because you are not really sure what links against the lib, you can do some manual work but most often a reboot

Libs are always a pain to patch at the OS level, because you are not really sure what links against the lib, you can do some manual work but most often a reboot is way easier. Here is a pretty common pattern, that I use, if I cannot reboot right away. Doesn't hurt to go through the motions, then you have a pretty good idea of what needs to be done, stops the panic patch work ;) On RHEL/CentOS, you can use needs-restarting, to tell you what processes need restarting after a lib update. sudo yum update sudo yum install yum-utils.noarch sudo needs-restarting On Debian/Ubuntu, you can use checkrestart, to tell you what processes need restarting after a lib update. sudo apt-get update sudo apt-get upgrade sudo apt-get install debian-goodies sudo checkrestart -v Helps to work through this manually, wrap your head around what needs to be done, then you can push that into automation tools if you have a large enough infrastructure. Here's a screencast about the pattern for anyone interested in learning more. [1] https://sysadmincasts.com/episodes/44-patching-the-ghost-glibc-gethostbyname-cve-2015-0235-bug https://sysadmincasts.com/episodes/44-patching-the-ghost-gli...