"apt-mark hold" ignored by Update Manager

[Christopher Barrington-Leigh]

Update manager keeps telling me there's software to upgrade, but there is only a package on the do-not-upgrade list:

When I try upgrading from the command line, I see:

Calculating upgrade... Done
The following packages have been kept back:
  offlineimap
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

Since I clearly don't want this upgraded, I should not be told that there are packages awaiting upgrade by GUIs pop-ups or in the GUI control window.

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: update-manager 1:16.04.3
ProcVersionSignature: Ubuntu 4.4.0-22.40-generic 4.4.8
Uname: Linux 4.4.0-22-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
CurrentDesktop: Unity
Date: Fri May 27 12:27:54 2016
EcryptfsInUse: Yes
InstallationDate: Installed on 2016-02-12 (104 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
PackageArchitecture: all
SourcePackage: update-manager
UpgradeStatus: Upgraded to xenial on 2016-05-24 (2 days ago)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[dronus (paul-geisler)]

Affects 14.04 LTS too. The update manager proposes security updates for packages on hold.

Will it install them? I don't know, I won't risk it now.

[EricDHH (ericdhh)]

Affects 17.10

Update manager updates a firefox on hold while in use, crashed it and enforce a newer but incompatible version.

This is finitely not okay.

[EricDHH (ericdhh)]

Possible Workaround: Disable artful security upgrades in synaptic

Like to see a discussion about that, why ubuntu upgrade your browser on HOLD while homebanking. What result in a crash and 'restart firefox' at some place. Thus is security imminent, if someone infuse a bugged package into ubuntu, the user have no chance to stop it's installation now?