It is very easy to upgrade the whole Debian system, but you can also upgrade only selected packages and skip the rest.
List available updates by simulating upgrade process.
$ sudo apt-get upgrade -s
Reading package lists... Done Building dependency tree Reading state information... Done The following packages will be upgraded: gnupg gpgv libgcrypt11 libssl-dev libssl-doc libssl1.0.0 linux-headers-3.2.0-4-amd64 linux-headers-3.2.0-4-common linux-image-3.2.0-4-amd64 linux-libc-dev openssl 11 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Inst libgcrypt11 [1.5.0-5+deb7u4] (1.5.0-5+deb7u5 Debian-Security:7.0/oldstable [amd64]) Inst libssl-doc [1.0.1e-2+deb7u21] (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [all]) Inst libssl-dev [1.0.1e-2+deb7u21] (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [amd64]) [] Inst libssl1.0.0 [1.0.1e-2+deb7u21] (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [amd64]) Inst linux-image-3.2.0-4-amd64 [3.2.81-1] (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) Inst gpgv [1.4.12-7+deb7u7] (1.4.12-7+deb7u8 Debian-Security:7.0/oldstable [amd64]) Conf gpgv (1.4.12-7+deb7u8 Debian-Security:7.0/oldstable [amd64]) Inst gnupg [1.4.12-7+deb7u7] (1.4.12-7+deb7u8 Debian-Security:7.0/oldstable [amd64]) Conf gnupg (1.4.12-7+deb7u8 Debian-Security:7.0/oldstable [amd64]) Inst linux-headers-3.2.0-4-amd64 [3.2.81-1] (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) [] Inst linux-headers-3.2.0-4-common [3.2.81-1] (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) Inst linux-libc-dev [3.2.81-1] (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) Inst openssl [1.0.1e-2+deb7u21] (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [amd64]) Conf libgcrypt11 (1.5.0-5+deb7u5 Debian-Security:7.0/oldstable [amd64]) Conf libssl-doc (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [all]) Conf libssl1.0.0 (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [amd64]) Conf libssl-dev (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [amd64]) Conf linux-image-3.2.0-4-amd64 (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) Conf linux-headers-3.2.0-4-common (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) Conf linux-headers-3.2.0-4-amd64 (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) Conf linux-libc-dev (3.2.81-2 Debian-Security:7.0/oldstable [amd64]) Conf openssl (1.0.1t-1+deb7u1 Debian-Security:7.0/oldstable [amd64])
Install updates, but skip these related to Linux kernel.
$ apt-get install --only-upgrade libgcrypt11 libssl-dev libssl-doc libssl1.0.0 linux-libc-dev openssl
Reading package lists... Done Building dependency tree Reading state information... Done Suggested packages: rng-tools The following packages will be upgraded: libgcrypt11 libssl-dev libssl-doc libssl1.0.0 linux-libc-dev openssl 6 upgraded, 0 newly installed, 0 to remove and 5 not upgraded. Need to get 5857 kB/6158 kB of archives. After this operation, 265 kB of additional disk space will be used. Get:1 http://security.debian.org/ wheezy/updates/main libssl-doc all 1.0.1t-1+deb7u1 [1224 kB] Get:2 http://security.debian.org/ wheezy/updates/main libssl-dev amd64 1.0.1t-1+deb7u1 [1791 kB] Get:3 http://security.debian.org/ wheezy/updates/main libssl1.0.0 amd64 1.0.1t-1+deb7u1 [1283 kB] Get:4 http://security.debian.org/ wheezy/updates/main linux-libc-dev amd64 3.2.81-2 [858 kB] Get:5 http://security.debian.org/ wheezy/updates/main openssl amd64 1.0.1t-1+deb7u1 [700 kB] Fetched 4735 kB in 2s (1990 kB/s) Reading changelogs... Done Preconfiguring packages ... (Reading database ... 58380 files and directories currently installed.) Preparing to replace libgcrypt11:amd64 1.5.0-5+deb7u4 (using .../libgcrypt11_1.5.0-5+deb7u5_amd64.deb) ... Unpacking replacement libgcrypt11:amd64 ... Preparing to replace libssl-doc 1.0.1e-2+deb7u21 (using .../libssl-doc_1.0.1t-1+deb7u1_all.deb) ... Unpacking replacement libssl-doc ... Preparing to replace libssl-dev 1.0.1e-2+deb7u21 (using .../libssl-dev_1.0.1t-1+deb7u1_amd64.deb) ... Unpacking replacement libssl-dev ... Preparing to replace libssl1.0.0:amd64 1.0.1e-2+deb7u21 (using .../libssl1.0.0_1.0.1t-1+deb7u1_amd64.deb) ... Unpacking replacement libssl1.0.0:amd64 ... Preparing to replace linux-libc-dev:amd64 3.2.81-1 (using .../linux-libc-dev_3.2.81-2_amd64.deb) ... Unpacking replacement linux-libc-dev:amd64 ... Preparing to replace openssl 1.0.1e-2+deb7u21 (using .../openssl_1.0.1t-1+deb7u1_amd64.deb) ... Unpacking replacement openssl ... Processing triggers for man-db ... Setting up libgcrypt11:amd64 (1.5.0-5+deb7u5) ... Setting up libssl-doc (1.0.1t-1+deb7u1) ... Setting up libssl1.0.0:amd64 (1.0.1t-1+deb7u1) ... Setting up libssl-dev (1.0.1t-1+deb7u1) ... Setting up linux-libc-dev:amd64 (3.2.81-2) ... Setting up openssl (1.0.1t-1+deb7u1) ...
This command will upgrade only installed packages, it will ignore non installed ones.