Security updates

Many software versions are becoming non-secure in time, new holes are founded, security bugs, etc...

As I understand in Ubuntu the only way to upgrade the installed package is to upgrade all installed packages (with "apt-get upgrade" command). If I have just 1 vurnerable service (for example Apache) and i want to upgrade it to next more secure version, so I should upgrade all the packages installed with the "apt-get upgrade" or what should i do?

I'm new to ubuntu so i'm asking such questions.

If I have for example vurnerable kernel on my Ubuntu server , can I upgrade just kernel or I have to do "apt-get upgrade-distr" to upgrade my all system and kernel with it?