Microsoft Alerts

Windows Update Client Win7, Win8.1 - Updated MS15-046, MS15-081, MS15-099

FYI... Windows Update Client Win7, Win8.1 - Updated MS15-046, MS15-081, MS15-099...

Windows Update Client for Windows 7 and Windows Server 2008 R2: October 2015
- https://support.microsoft.com/en-us/kb/3083710
Last Review: 10/13/2015 18:31:00 - Rev: 2.0
Applies to:
Windows Server 2008 R2 Service Pack 1
Windows 7 Service Pack 1
Windows Embedded Standard 7 Service Pack 1
___

Windows Update Client for Windows 8.1 and Windows Server 2012 R2: October 2015
- https://support.microsoft.com/en-us/kb/3083711
Last Review: 10/13/2015 18:33:00 - Rev: 2.0
Applies to:
Windows Server 2012 R2 Datacenter
Windows Server 2012 R2 Standard
Windows Server 2012 R2 Essentials
Windows Server 2012 R2 Foundation
Windows 8.1 Enterprise
Windows 8.1 Pro
Windows 8.1
Windows RT 8.1
___

Microsoft Security Bulletin MS15-046 - Important
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3057181)
- https://technet.microsoft.com/en-us/library/security/ms15-046.aspx
Published: May 12, 2015 | Updated: October 13, 2015
V4.0 (October 13, 2015): Revised bulletin to announce the availability of a new update (3085544) for Microsoft Office 2007 that addresses issues with the previously-released update (2965282). Customers running Microsoft Office 2007 are encouraged to install update 3085544 at the earliest opportunity to be fully protected from the vulnerability discussed in this bulletin. Customers running other Microsoft Office software do not need to take any action. See Microsoft Knowledge Base Article 3085544* for more information and download links.
* https://support.microsoft.com/en-us/kb/3085544

Microsoft Security Bulletin MS15-081 - Critical
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3080790)
- https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Published: August 11, 2015 | Updated: October 13, 2015
V3.0 (October 13, 2015): Revised bulletin to announce the availability of update packages for Microsoft Office 2016, Microsoft Visio 2016, and Microsoft Word 2016. Customers running Microsoft Office 2016, Microsoft Visio 2016, or Microsoft Word 2016 should apply the applicable updates to be protected from the vulnerabilities discussed in this bulletin. The majority of customers have automatic updating enabled and will not need to take any action because the updates will be downloaded and installed automatically.

Microsoft Security Bulletin MS15-099 - Critical
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664)
- https://technet.microsoft.com/en-us/library/security/ms15-099.aspx
Published: September 8, 2015 | Updated: October 13, 2015
V4.0 (October 13, 2015): Revised bulletin to announce the availability of an update package for Microsoft Excel 2016. Customers running Microsoft Excel 2016 should apply update 2920693 to be protected from the vulnerabilities discussed in this bulletin. The majority of customers have automatic updating enabled and will not need to take any action because the update will be downloaded and installed automatically.
___

>> https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/10/13/patch-tuesday-october-2015
Oct 13, 2015
___

Compatibility update for upgrading to Windows 10: October 14, 2015
- https://support.microsoft.com/en-us/kb/3097626
Last Review: 10/14/2015 16:34:00 - Rev: 2.0

:fear::fear:
 
Last edited:
IE 10, 11, Edge - Flash updated

FYI...

Microsoft Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge
- https://technet.microsoft.com/en-us/library/security/2755801
Updated: Oct 19, 2015 - Ver: 49.0 - "Microsoft is announcing the availability of an update for Adobe Flash Player in Internet Explorer on all supported editions of Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10; the update is also available for Adobe Flash Player in Microsoft Edge on all supported editions of Windows 10. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10, Internet Explorer 11, and Microsoft Edge...
On October 19, 2015, Microsoft released an update (3105216) for Internet Explorer 10 on Windows 8, Windows Server 2012, and Windows RT; Internet Explorer 11 on Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10; and Microsoft Edge on Windows 10. The update addresses the vulnerabilities described in Adobe Security bulletin APSB15-27*. For more information about this update, including download links, see Microsoft Knowledge Base Article 3105216**...
* https://helpx.adobe.com/security/products/flash-player/apsb15-27.html
Oct 16, 2015
** https://support.microsoft.com/en-us/kb/3105216
Last Review: 10/19/2015 21:09:00 - Rev: 1.0

:fear:
 
Win10 'Nagware' ...

FYI... Win10 'Nagware'

Update installs 'Get Windows 10 app' in Windows 8.1 and Windows 7 SP1
- https://support.microsoft.com/en-us/kb/3035583
Last Review: 10/05/2015 16:45:00 - Rev: 6.0
___

Nagware KB 3035583 is marked 'Important' on some PCs and will thus install on Automatic Update
- http://www.infoworld.com/article/29...ing-patches-return-kb-3035583-kb-2952664.html
Oct 6, 2015

Disable Windows 10 upgrade 'nagware' on Windows 7, Windows 8.1 computers
- http://www.infoworld.com/article/29...agware-on-windows-7-windows-81-computers.html
Oct 14, 2015

Microsoft says that the optional update was enabled by mistake
>> http://arstechnica.com/information-...ng-automatically-on-some-windows-7-8-systems/
Oct 15, 2015

"HIDE 'UPDATE'" ?

:fear::fear::fear:
 
Last edited:
Win10 System Center Configuration Manager

FYI...

Win10 System Center Configuration Manager
- http://blogs.technet.com/b/configmg...-configmgr-support-for-win-10-and-intune.aspx
27 Oct 2015 - "... Windows 10 comes in two basic flavors: (1) a Current Branch (also known as Windows-as-a-Service) and (2) the Long-Term Servicing Branch with a more traditional support model. The Current Branch also has the option of Current Branch for Business, which is the same build as the Current Branch, just deferred to a later date to give you time to further validate in your environment. If this is all news to you, stop reading and click here* for more information and guidance. Then come on back when you are ready.
* https://technet.microsoft.com/en-us/library/mt598226(v=vs.85).aspx
... we will release a -new- version of Configuration Manager by the end of this calendar year. This -new- version will bring -full- support for the deployment, upgrade, and management of Windows 10. The new System Center Configuration Manager, as it will simply be called, is designed to support the much faster pace of updates for Windows 10 and Microsoft Intune. This -new- version will also simplify the Configuration Manager upgrade experience itself, and allow us to listen and more quickly respond to your feedback...
'In Summary: Planning and Guidance'..." (see the chart there).

:fear::fear:
 
Installing and searching for updates is slow - KB 3102810

FYI...

Installing and searching for updates is slow and high CPU usage occurs in Win7 and Win Server 2008 R2
- https://support.microsoft.com/en-us/kb/3102810
Last Review: 11/04/2015 03:09:00 - Rev: 2.0
Applies to:
Windows Server 2008 R2 Service Pack 1
Windows 7 Service Pack 1

Also:
Installing and searching for updates is slow and high CPU usage occurs in Win8.1 and Win Server 2012 R2
- https://support.microsoft.com/en-us/kb/3102812
Last Review: 11/04/2015 03:09:00 - Rev 2.0

Hmmm... :blink:

:fear::fear:
 
Last edited:
MS Security Bulletin Summary - November 2015

FYI...

- https://technet.microsoft.com/en-us/library/security/ms15-nov
Nov 10, 2015 - "This bulletin summary lists security bulletins released for November 2015...
(Total of -12-)

Microsoft Security Bulletin MS15-112 - Critical
Cumulative Security Update for Internet Explorer (3104517)
- https://technet.microsoft.com/library/security/MS15-112
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Internet Explorer

Microsoft Security Bulletin MS15-113 - Critical
Cumulative Security Update for Microsoft Edge (3104519)
- https://technet.microsoft.com/library/security/MS15-113
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Microsoft Edge

Microsoft Security Bulletin MS15-114 - Critical
Security Update for Windows Journal to Address Remote Code Execution (3100213)
- https://technet.microsoft.com/library/security/MS15-114
Critical - Remote Code Execution - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-115 - Critical
Security Update for Microsoft Windows to Address Remote Code Execution (3105864)
- https://technet.microsoft.com/library/security/MS15-115
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-116 - Important
Security Update for Microsoft Office to Address Remote Code Execution (3104540)
- https://technet.microsoft.com/library/security/MS15-116
Important - Remote Code Execution - May require restart - Microsoft Office, Microsoft Office Services and Web Apps, Microsoft Lync, Skype for Business

Microsoft Security Bulletin MS15-117 - Important
Security Update for NDIS to Address Elevation of Privilege (3101722)
- https://technet.microsoft.com/library/security/MS15-117
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-118 - Important
Security Update for .NET Framework to Address Elevation of Privilege
- https://technet.microsoft.com/library/security/MS15-118
Important - Elevation of Privilege - Does not require restart - Microsoft Windows, Microsoft .NET Framework

Microsoft Security Bulletin MS15-119 - Important
Security Update for Winsock to Address Elevation of Privilege (3104521)
- https://technet.microsoft.com/library/security/MS15-119
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-120 - Important
Security Update for IPSec to Address Denial of Service (3102939)
- https://technet.microsoft.com/library/security/MS15-120
Important - Denial of Service - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-121 - Important
Security Update for Schannel to Address Spoofing (3081320)
- https://technet.microsoft.com/library/security/MS15-121
Important - Spoofing - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-122 - Important
Security Update for Kerberos to Address Security Feature Bypass (3105256)
- https://technet.microsoft.com/library/security/MS15-122
Important - Security Feature Bypass - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-123 - Important
Security Update for Skype for Business and Microsoft Lync to Address Information Disclosure (3105872)
- https://technet.microsoft.com/library/security/MS15-123
Important - Information Disclosure - May require restart - Microsoft Lync, Skype for Business
___

MS15-112: http://www.securitytracker.com/id/1034112
MS15-113: http://www.securitytracker.com/id/1034113
MS15-114: http://www.securitytracker.com/id/1034110
MS15-115: http://www.securitytracker.com/id/1034114
MS15-116: http://www.securitytracker.com/id/1034117
- http://www.securitytracker.com/id/1034119
- http://www.securitytracker.com/id/1034122
MS15-117: http://www.securitytracker.com/id/1034115
MS15-118: http://www.securitytracker.com/id/1034116
MS15-119: http://www.securitytracker.com/id/1034121
MS15-120: http://www.securitytracker.com/id/1034123
MS15-121: http://www.securitytracker.com/id/1034124
MS15-122: http://www.securitytracker.com/id/1034125
MS15-123: http://www.securitytracker.com/id/1034126
- http://www.securitytracker.com/id/1034127
___

- http://blogs.technet.com/b/msrc/arc...ber-2015-security-update-release-summary.aspx
10 Nov 2015 - "Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released..."

Security Advisories:
Microsoft Security Advisory 3108638
Update for Windows Hyper-V to Address CPU Weakness
- https://technet.microsoft.com/library/security/3108638.aspx
Nov 10, 2015

Microsoft Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge
- https://technet.microsoft.com/library/security/2755801.aspx
Nov 10, 2015 V50.0
___

Nov 2015 Office Update Release
- http://blogs.technet.com/b/office_s...1/10/november-2015-office-update-release.aspx
10 Nov 2015 - "... there are -60- security updates (2 bulletins) and 39 non-security updates..."
MS15-099 (updated): https://technet.microsoft.com/en-us/library/security/MS15-099
MS15-116: https://technet.microsoft.com/en-us/library/security/MS15-116
"... All of the security and non-security updates for November are listed in KB article 3108456..."
> https://support.microsoft.com/en-us/kb/3108456
___

ISC Analysis
- https://isc.sans.edu/diary.html?storyid=20359
2015-11-10 18:05:54 UTC

.
 
Last edited:
MS15-115 - KB3097877 trouble reports...

FYI...

MS15-115 -KB3097877 causing severe difficulties for some Win7 users
- http://myonlinesecurity.co.uk/kb309...indows-7-users-november-2015-windows-updates/
11 Nov 2015 - "KB3097877 causing severe difficulties for some Windows 7 users November 2015 Windows updates. We are seeing numerous reports from Windows 7 users about difficulties logging on to windows after doing the November 2015 patch Tuesday updates. We are also hearing about crashes in Outlook 2010 and 2013 when viewing HTML emails.
We also are hearing about crashes in gadgets in windows sidebar on Windows 7 computers. Gadgets have been deprecated and are not recommended for use any longer due to security issues...
All the problems appear to be caused by KB3097877 which is part of a vital security update included in MS15-115. This update is a security update that updates Win32k.sys and Gdiplus.dll to help prevent a remote code execution if an attacker convinces a user to open a specially crafted document or to go to an untrusted webpage that contains embedded fonts.
Best advice we can give at the moment is NOT to install KB3097877 on any Windows7 computer until Microsoft have investigated and issued a workaround or revised patch. If you are suffering from Crashes in Outlook, then -uninstall- KB3097877..."

MS15-115: https://support.microsoft.com/en-us/kb/3097877
Last Review: 11/10/2015 18:28:00 - Rev: 1.0
___

>> https://social.technet.microsoft.co...viewing-html-emails?forum=officeitproprevious

>> http://www.infoworld.com/article/30...ook-causes-network-sign-in-black-screens.html
Nov 11, 2015

:fear::fear:
 
Last edited:
MS15-115 - re-released ...

FYI...

MS15-115 / re-released ...
- https://technet.microsoft.com/library/security/MS15-115
V2.0 (November 11, 2015): Bulletin revised to inform customers running Windows 7 that the 3097877 update has been re-released to address an issue that caused crashes for some customers when they viewed certain emails. Customers who previously installed update 3097877 should -reinstall- the update to correct this known issue. See Microsoft Knowledge Base Article 3097877* for more information.

* https://support.microsoft.com/en-us/kb/3097877
Last Review: 11/11/2015 22:26:00 - Rev: 2.0 - "... Issues in this security update: We are aware of reports of crashes in all supported versions of Microsoft Outlook that occur when users are reading certain emails after this update is installed..."

:fear::fear:
 
Last edited:
MS15-115 - re-released r5, r8 / MS15-112 - IE11

FYI...

MS15-115 / re-released ...
- https://technet.microsoft.com/library/security/MS15-115
V2.0 (November 12, 2015): Bulletin revised to inform customers that the 3097877* update for Windows 7 and Windows Server 2008 R2 has been rereleased to correct a problem with the original update that could cause some applications to quit unexpectedly. Customers who have already successfully installed the update on Windows 7 or Windows Server 2008 R2 systems should reinstall the update.

* https://support.microsoft.com/en-us/kb/3097877
Last Review: 11/12/2015 19:00:00 - Rev: 5.0
___

- https://support.microsoft.com/en-us/kb/3097877
Last Review: 11/13/2015 02:21:00 - Rev: 8.0 <<
___

MS15-112 - File is "moved or deleted" or "cannot be found" error when you download PDF files in Internet Explorer 11 in Windows
- https://support.microsoft.com/en-us/kb/3110711
Last Review: 11/13/2015 07:25:00 - Rev: 3.0 <
"Prerequisites... you must install MS15-112: Security update for Internet Explorer: November 10, 2015 before you install this hotfix..."

:fear::fear:
 
Last edited:
MS pulls Win10 v 1511 from download page

FYI...

MS pulls Win10 v 1511 Threshold 2 release from download page
- http://www.infoworld.com/article/30...1-threshold-2-release-from-download-page.html
Nov 23, 2015 - "... If you have a copy of the v 1511 ISO running around - you might've created it with the Media Creation Tool prior to last weekend, or you can still download it from MSDN - you can still upgrade straight to 1511. But if you don't have one in your back pocket, you get to upgrade twice. Why do I get the feeling that Microsoft is making this up as it goes along?"

:fear: :sad:
 
Latest Win10 Update may remove programs automatically

FYI...

Beware, latest Win10 Update may remove programs automatically
- http://www.ghacks.net/2015/11/24/beware-latest-windows-10-update-may-remove-programs-automatically/
Nov 24, 2015 - "Microsoft's Windows 10 operating system may uninstall programs - desktop programs that is - from the computer after installation of the big Fall update that the company released earlier this month. I noticed the issue on one PC that I upgraded to Windows 10 Version 1511 but not on other machines. The affected PC had Speccy*, a hardware information program, installed and Windows 10 notified me after the upgrade that the software had been -removed- from the system because of incompatibilities. There was no indication beforehand that something like this would happen, and what made this rather puzzling was the fact that a newly downloaded copy of Speccy would install and run fine on the upgraded system. According to reports on the Internet**, Speccy is not the only program affected by this. Others report that programs like CPU-Z, AMD Catalyst Control Center or CPUID were removed as well during the upgrade... While this could very well be a bug that slipped by Microsoft's quality control, it is a serious issue not only because of the removal itself, but also when it comes to the future of the operating system. The removal itself is bad enough. First, Microsoft should have the decency to inform users about the issue before the software is removed. Either do a check prior to running the upgrade or afterwards. Then, all reports indicate that the forcefully uninstalled software would install and run fine on the system without issues. This makes it more likely that a bug caused the issue and that it was not a deliberate action programmed into the update. The outlook is even worse. Who in their right mind would install an operating system that might remove installed software - maybe even paid for software or critical software - without user interaction or consent, especially if it turns out later that the software works just fine on the system? Windows 10 users give up control and since there is no way of telling if software will be removed after a Windows update, should consider backing up the system regularly before system updates so that it can be restored to an earlier stage if important software was removed by the update..."
* https://www.piriform.com/speccy

** https://www.reddit.com/r/Windows10/comments/3twg2m/windows_10_is_uninstalling_user_apps_without/

> https://www.reddit.com/r/Windows10/comments/3strsd/installed_the_fall_update_windows_10_decided_to/
___

Some settings may not have been retained when applying the November update (Version 1511)
- https://support.microsoft.com/en-us/kb/3121244
Last Review: 11/24/2015 22:01:00 - Rev: 1.0
Applies to: Windows 10
___

- http://windowssecrets.com/patch-watch/shopping-online-check-your-browsers-security/
Nov 26, 2015 - "... on Jan. 12, 2016, Microsoft is folding up the tent on Internet Explorer 7 and 8. After that date, only IE 9 on Vista, IE 10 on Windows Server 2012, and IE 11 on Windows 7 and 8.1 will get security updates. If you stick with an outdated version of IE, your vulnerability to malware will rise quickly..."
> http://blogs.msdn.com/b/ie/archive/2014/08/07/stay-up-to-date-with-internet-explorer.aspx

- http://www.computerworld.com/articl...0m-ie-users-have-just-6-weeks-to-upgrade.html
Dec 1, 2015 - "Nearly 370 million Internet Explorer users have just six weeks to upgrade their browsers... The retired browsers will continue working, but Microsoft will halt technical support and -stop- serving security updates for the banned versions. According to data released by measurement vendor Net Applications, 44.8% of all IE users ran a soon-to-be-outdated edition of the browser... Companies that require older editions of IE to run Web apps or services can upgrade to IE11, then rely on that browser's 'Enterprise Mode' to mimic the older versions' rendering engines. Last week, Microsoft announced some enhancements to Enterprise Mode, including support for HTTP ports, and issued a kit that walks IT administrators through the chore of configuring Enterprise Mode. That kit can be downloaded from here*..."
* https://technet.microsoft.com/en-us/browser/mt612809

> https://technet.microsoft.com/en-us/browser/mt126196

:fear::fear::fear:
 
Last edited:
KB 3112336 and KB 3112343 are all about Win10

FYI...

KB 3112336 and KB 3112343 are all about Win10
- http://www.infoworld.com/article/30...-and-kb-3112343-are-all-about-windows-10.html
Dec 2, 2015 - "Yesterday Microsoft released two big updates for its Windows Update Client. Those of you using Windows 7 have KB 3112343, and those with Windows 8.1 get KB 3112336.
Both updates appear to grease the skids for in-place upgrading to Windows 10. Unfortunately, the documentation is so sparse it's impossible to tell if the patches offer anything at all to users who don't intend to upgrade to Windows 10..."

Windows Update Client for Windows 7 and Windows Server 2008 R2
- https://support.microsoft.com/en-us/kb/3112343
Last Review: 12/02/2015 03:30:00 - Revision: 3.0
Applies to:
Windows Server 2008 R2 Service Pack 1
Windows 7 Service Pack 1

Windows Update Client for Windows 8.1 and Windows Server 2012 R2
- https://support.microsoft.com/en-us/kb/3112336
Last Review: 12/02/2015 03:30:00 - Revision: 3.0
Applies to:
Windows Server 2012 R2 Datacenter
Windows Server 2012 R2 Standard
Windows Server 2012 R2 Essentials
Windows Server 2012 R2 Foundation
Windows 8.1 Enterprise
Windows 8.1 Pro
Windows 8.1
Windows RT 8.1
___

Windows 10 devices can't connect to an 802.1X environment
- https://support.microsoft.com/en-us/kb/3121002
Last Review: 11/25/2015 00:55:00 - Rev: 2.0
Applies to:
Windows 10

:fear::fear:
 
Last edited:
KB 3116908 for Win10 v1511 triggers errors

FYI...

Cumulative update KB 3116908 for Windows 10 version 1511 triggers errors
- http://www.infoworld.com/article/30...-windows-10-version-1511-triggers-errors.html
Dec 3, 2015 - "The sun may still be rising in the United States, but other parts of the world are already struggling with the latest cumulative update for Windows 10 version 1511 (a.k.a. build 10586, Threshold 2, or the Fall Update). The official Microsoft explanation for this new patch, known as KB 3116908, just says:
'This update includes improvements to enhance the functionality of Windows 10 Version 1511'...
Of course, if your PC is still stuck on the July 29 RTM version of Windows 10 - build 10240 - you are -not- getting any recent cumulative updates... Here's how to check your PC to see if you're on the latest upgrade trail. Start with the About Windows dialog (see screenshot*), which you can get to by typing "winver" in the Cortana search box and pressing Enter:
* http://core0.staticworld.net/images...1-build-10586-about-100631293-medium.idge.jpg
If you see "Version 10.0 (Build 10240)" on the second line, you're still running the original July 29 RTM version of Windows 10. There are many reasons why you might still be stuck on the original Win10. Perhaps the installer for version 1511 has repeatedly failed to run. Build 1511 also won't install if you upgraded from Win7 or 8.1 to Win10 fewer than 30 days previously and there's still a windows.old folder on your system. (If you aren't going to roll back to Win7 or 8.1, using an admin account, right-click on your c: drive and then choose Properties > Disk Cleanup > Clean up system files.) If you see "Version 1511 (OS Build 10586)," as in the screenshot, you have the first version of Threshold 2, which shipped on Nov. 12. Variously known as the Win10 Fall Update, November Update, Threshold 2, and other less-printable epithets, it's the version of Windows 10 that (in my opinion) should've been called Win 10.1 or Win10 SP1 or Win10 SU1... [released] just three weeks ago, Windows 10 version 1511 has gone through -several- major changes. Cumulative updates change the OS build number, and you can judge your PC's progress at installing those updates by looking at the build number... -Four- cumulative updates in three weeks, 230MB of changes with essentially no documentation... In addition, there have been several other updates to build 1511 whose exact functions have not been well documented..."

> https://support.microsoft.com/en-us/kb/3116908
Last Review: 12/03/2015 01:46:00 - Rev: 1.0

:fear::fear:
 
IE11 - mandatory update by 1.12.2016

FYI...

MS update IE mandate - 1.12.2016 update ...
- http://windowssecrets.com/patch-watch/shopping-online-check-your-browsers-security/
Nov 26, 2015 - "... on Jan. 12, 2016, Microsoft is folding up the tent on Internet Explorer 7 and 8. After that date, only IE 9 on Vista, IE 10 on Windows Server 2012, and IE 11 on Windows 7 and 8.1 will get security updates. If you stick with an outdated version of IE, your vulnerability to malware will rise quickly..."
> http://blogs.msdn.com/b/ie/archive/2014/08/07/stay-up-to-date-with-internet-explorer.aspx

- http://www.computerworld.com/articl...0m-ie-users-have-just-6-weeks-to-upgrade.html
Dec 1, 2015 - "Nearly 370 million Internet Explorer users have just six weeks to upgrade their browsers... The retired browsers will continue working, but Microsoft will halt technical support and -stop- serving security updates for the banned versions. According to data released by measurement vendor Net Applications, 44.8% of all IE users ran a soon-to-be-outdated edition of the browser... Companies that require older editions of IE to run Web apps or services can upgrade to IE11, then rely on that browser's 'Enterprise Mode' to mimic the older versions' rendering engines. Last week, Microsoft announced some enhancements to Enterprise Mode, including support for HTTP ports, and issued a kit that walks IT administrators through the chore of configuring Enterprise Mode. That kit can be downloaded from here*..."
* https://technet.microsoft.com/en-us/browser/mt612809

> https://technet.microsoft.com/en-us/browser/mt126196
___

IE11 for Win7...
> https://www.microsoft.com/en-us/download/internet-explorer-11-for-windows-7-details.aspx

:fear::fear:
 
Last edited:
IE Sunset and XP Embedded End of Support

FYI...

IE Sunset and XP Embedded End of Support
- https://isc.sans.edu/diary.html?storyid=20459
Last Updated: 2015-12-08 - "... Rumor has it that with today's patch Tuesday, Microsoft may re-enable the auto-upgrade to Windows 10. You may flip the switch back to not update, but it will set itself to "on" once a day..."

[1] https://www.microsoft.com/en-us/WindowsForBusiness/End-of-IE-support
[2] https://support.microsoft.com/en-us/lifecycle/search/default.aspx?=&alpha=Windows XP
​[3] http://www.computerworld.com/articl...-for-massive-windows-10-upgrade-strategy.html

:fear::fear:
 
MS Bulletin Summary - December 2015

FYI...

- https://technet.microsoft.com/en-us/library/security/ms15-Dec
Dec 8, 2015 - "This bulletin summary lists security bulletins released for December 2015...
(Total of -12-)

Microsoft Security Bulletin MS15-124 - Critical
Cumulative Security Update for Internet Explorer (3116180)
- https://technet.microsoft.com/library/security/MS15-124
Critical - Remote Code Execution- Requires restart - Microsoft Windows, Internet Explorer

Microsoft Security Bulletin MS15-125 - Critical
Cumulative Security Update for Microsoft Edge (3116184)
- https://technet.microsoft.com/library/security/MS15-125
Critical - Remote Code Execution- Requires restart - Microsoft Windows, Microsoft Edge

Microsoft Security Bulletin MS15-126 - Critical
Cumulative Security Update for JScript and VBScript to Address Remote Code Execution (3116178)
- https://technet.microsoft.com/library/security/MS15-126
Critical - Remote Code Execution - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-127 - Critical
Security Update for Microsoft Windows DNS to Address Remote Code Execution (3100465)
- https://technet.microsoft.com/library/security/MS15-127
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-128 - Critical
Security Update for Microsoft Graphics Component to Address Remote Code Execution (3104503)
- https://technet.microsoft.com/library/security/MS15-128
Critical - Remote Code Execution - Requires restart - Microsoft Windows, Microsoft .NET Framework, MS Office, Skype for Business, Microsoft Lync, Silverlight

Microsoft Security Bulletin MS15-129 - Critical
Security Update for Silverlight to Address Remote Code Execution (3106614)
- https://technet.microsoft.com/library/security/MS15-129
Critical - Remote Code Execution - Does not require a restart - Microsoft Silverlight

Microsoft Security Bulletin MS15-130 - Critical
Security Update for Microsoft Uniscribe to Address Remote Code Execution (3108670)
- https://technet.microsoft.com/library/security/MS15-130
Critical - Remote Code Execution - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-131 - Critical
Security Update for Microsoft Office to Address Remote Code Execution (3116111)
- https://technet.microsoft.com/library/security/MS15-131
Critical - Remote Code Execution - May require restart - Microsoft Office

Microsoft Security Bulletin MS15-132 - Important
Security Update for Microsoft Windows to Address Remote Code Execution (3116162)
- https://technet.microsoft.com/library/security/MS15-132
Important - Remote Code Execution - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-133 - Important
Security Update for Windows PGM to Address Elevation of Privilege (3116130)
- https://technet.microsoft.com/library/security/MS15-133
Important - Elevation of Privilege - Requires restart - Microsoft Windows

Microsoft Security Bulletin MS15-134 - Important
Security Update for Windows Media Center to Address Remote Code Execution (3108669)
- https://technet.microsoft.com/library/security/MS15-134
Important - Remote Code Execution - May require restart - Microsoft Windows

Microsoft Security Bulletin MS15-135 - Important
Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege (3119075)
- https://technet.microsoft.com/library/security/MS15-135
Important - Elevation of Privilege - Requires restart - Microsoft Windows
___

MS15-124: http://www.securitytracker.com/id/1034315
MS15-125: http://www.securitytracker.com/id/1034316
MS15-126: http://www.securitytracker.com/id/1034317
MS15-127: http://www.securitytracker.com/id/1034323
MS15-128: http://www.securitytracker.com/id/1034329
- http://www.securitytracker.com/id/1034330
- http://www.securitytracker.com/id/1034331
- http://www.securitytracker.com/id/1034332
- http://www.securitytracker.com/id/1034333
- http://www.securitytracker.com/id/1034336
MS15-129: http://www.securitytracker.com/id/1034321
MS15-130: http://www.securitytracker.com/id/1034337
MS15-131: http://www.securitytracker.com/id/1034324
- http://www.securitytracker.com/id/1034325
MS15-132: http://www.securitytracker.com/id/1034338
MS15-133: http://www.securitytracker.com/id/1034339
MS15-134: http://www.securitytracker.com/id/1034335
MS15-135: http://www.securitytracker.com/id/1034334
___

- http://blogs.technet.com/b/msrc/arc...ber-2015-security-update-release-summary.aspx
Dec 8, 2015 - "... we released security updates to provide additional protections against malicious attackers..."

Security Advisories (3):

Microsoft Security Advisory 3057154
Update to Harden Use of DES Encryption
- https://technet.microsoft.com/en-us/library/security/3057154
Published: July 14, 2015 | Updated: Dec 8, 2015

Microsoft Security Advisory 2755801
Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge
- https://technet.microsoft.com/en-us/library/security/2755801
Version: 51.0

Microsoft Security Advisory 3123040
Inadvertently Disclosed Digital Certificate Could Allow Spoofing
- https://technet.microsoft.com/en-us/library/security/3123040
Dec 8, 2015
___

December 2015 Office Update Release
- http://blogs.technet.com/b/office_s...2/08/december-2015-office-update-release.aspx
8 Dec 2015 - "... there are 19 security updates (2 bulletins) and 61 non-security updates..."
MS15-128: https://technet.microsoft.com/en-us/library/security/MS15-128

MS15-131: https://technet.microsoft.com/en-us/library/security/MS15-131
___

ISC Analysis
- https://isc.sans.edu/diary.html?storyid=20461
Last Updated: 2015-12-08

.
 
Last edited:
M$ Botched patch ...

FYI...

MS pulls botched patch KB 3114409 - triggered problems with Outlook 2010
- http://www.infoworld.com/article/30...hat-triggered-problems-with-outlook-2010.html
Dec 9, 2015 - "... Patch Tuesday update KB 3114409, intended to help admins keep Outlook 2010 from starting in safe mode, has in fact done just the opposite. Many Outlook 2010 customers report that installing KB 3114409 forces Outlook to start in safe mode. As of early Wednesday morning, the patch has been pulled, but if you're experiencing odd problems with Outlook 2010 -- it opens in safe mode only (always opens maximized and has no sounds, no reading pane, or other view settings that stick), has broken templates, and much more -- you should look at the KB 3114409 article* for instructions on how to -remove- the patch..."
* https://support.microsoft.com/en-us/kb/3114409
Last Review: 12/09/2015 05:42:00 - Rev: 4.0
"Notice: After you install this update, Outlook 2010 may start only in safe mode. If this issue occurs, uninstall the update. This update is no longer available now."
___

- https://isc.sans.edu/forums/diary/December+2015+Microsoft+Patch+Tuesday/20461/
(17 Comments)

:fear::fear::fear:
 
Last edited:
MS15-124 V1.1 / MS15-125 V1.1 / Nagware- patch KB 3035583

FYI...

MS Security Bulletin MS15-124 - Critical
Cumulative Security Update for Internet Explorer (3116180)
- https://technet.microsoft.com/en-us/library/security/MS15-124
V1.1 (December 16, 2015): Bulletin revised to further clarify the steps users must take to be protected from the vulnerability described in CVE-2015-6161*. This bulletin, MS15-124, provides protections for this issue, but user action is required to enable them; the cumulative update for Internet Explorer does not enable the protections by default**. Before applying the protections, Microsoft recommends that customers perform testing appropriate to their environment and system configurations.
* https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6161

** https://technet.microsoft.com/en-us/library/security/MS15-124#Fix_6161

MS15-124: Vulnerability in Internet Explorer could lead to ASLR bypass: December 16, 2015
> https://support.microsoft.com/en-us/kb/3125869
Last Review: 12/16/2015 22:23:00 - Rev: 1.0
Applies to:
Internet Explorer 11
Internet Explorer 10
Windows Internet Explorer 9
Windows Internet Explorer 8
Windows Internet Explorer 7
___

MS Security Bulletin MS15-125 - Critical
Cumulative Security Update for Microsoft Edge (3116184)
- https://technet.microsoft.com/en-us/library/security/MS15-125
V1.1 (December 16, 2015): Revised the vulnerability description for CVE-2015-6161 to more accurately describe the ASLR Bypass. This is an informational change only. Customers who have already successfully installed security update 3116869 or 3116900 do not need to take any action.
___

MS pushes Windows -nagware- patch KB 3035583 for sixth time
If you don’t want to install Windows 10 just yet, hide the patch - but run GWX Control Panel to be sure
- http://www.infoworld.com/article/30...-nagware-patch-kb-3035583-for-sixth-time.html
Dec 16, 2015 - "Last night Microsoft sent KB 3035583* down the Automatic Update chute. Again. The patch is listed as recommended, but -not- a security patch, for Windows 7 and 8.1 systems. Depending on your Windows Update settings... the patch will probably appear among your "Important" patches, and probably won't have its box checked. If that's what you see on your PC, KB 3035583 won't install unless you check the box and run Windows Update. As we've seen in the past, though, sometimes those unchecked patches suddenly get checked and Windows Update proceeds with the dirty deed. All the more reason to set Windows Update to "Notify but don't download." Your best bet right now, if you have Windows 7 or 8.1 and don't want to upgrade to Windows 10 just yet - remember, you have until July 28, 2016 to upgrade for free - is to cut KB 3035583 off at the knees. The easiest way to do that is by running GWX Control Panel**. Microsoft has provided no changelog, of course, and no indication what this version of Get Windows 10 does that's any different from the five previous versions..."
* https://support.microsoft.com/en-us/kb/3035583
Last Review: 12/15/2015 17:19:00 - Rev: 7.0
Applies to:
Windows 8.1 Pro
Windows 8.1
Windows 7 Service Pack 1

** http://ultimateoutsider.com/downloads/

:fear::fear:
 
Last edited:
You must log in or register to reply here.
Back
Top