Package maintainers often list bug fixes, build changes and security updates in a changelog. On Linux, this record can help distinguish a vendor-patched package from an older unpatched build that shares the same upstream version number.
Changelogs vary in detail. Some name a CVE or advisory directly, while others describe the fix less clearly. A changelog entry is evidence about a package release, not proof that this exact package is installed on every server or is currently running.
Different packaging systems expose the information differently. Debian-based systems may provide package changelogs through their repositories, while RPM-based systems can include changelog entries in package metadata. The vendor advisory often gives stronger security context.
When checking a patch, collect the installed package name and release, compare its changelog and advisory with the claimed fix, and verify that the application process uses the updated package.