News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon

Blog Archives

  • Microsoft surreptitiously adds telemetry functionality to July 2019 Win7 Security-only patch

    Posted on July 10th, 2019 at 05:33 PKCano Comment on the AskWoody Lounge

    Unannounced, Microsoft has added telemetry functionality to the July 2019 Security-only Update for Windows 7 KB4507456. Alerted on Patch Tuesday by an anonymous poster:

    Warning for group B Windows 7 users!

    The “July 9, 2019—KB4507456 (Security-only update)” is NOT “security-only” update.

    It replaces infamous KB2952664 and contains telemetry. Some details can be found in  file information for update 4507456 (keywords: “telemetry”, “diagtrack” and “appraiser”) and under http://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=7cdee6a8-6f30-423e-b02c-3453e14e3a6e (in “Package details”->”This update replaces the following updates” and there is KB2952664 listed).

    It doesn’t apply for IA-64-based systems, but applies both x64 and x86-based systems.

    Microsoft included the KB2952664 functionality (known as the “Compatibility Appraiser”) in the Security Quality Monthly Rollups for Windows 7 back in September 2018. The move was announced by Microsoft ahead of time.

    With the July 2019-07 Security Only Quality Update KB4507456, Microsoft has slipped this functionality into a security-only patch without any warning, thus adding the “Compatibility Appraiser” and its scheduled tasks (telemetry) to the update. The package details for KB4507456 say it replaces KB2952664 (among other updates).

    Come on Microsoft. This is not a security-only update. How do you justify this sneaky behavior? Where is the transparency now.

    Susan, we need your Pinocchio with a loooooong nose.

    UPDATE: Details on ComputerWorld. Woody on Windows

  • July 2019 Patch Tuesday has arrived

    Posted on July 9th, 2019 at 12:19 PKCano Comment on the AskWoody Lounge

    There are 212 entries in the Windows Update Catalog for July.

    Two major issues affecting all versions of Windows have been addressed by Microsoft, along with many other fixes affecting specific versions.

    • Addresses an issue that causes Internet Explorer 11 to stop working when it opens or interacts with Scalable Vector Graphics (SVG) markers, including Power BI line charts with markers.
    • Addresses an issue that may display the error, “MMC has detected an error in a snap-in and will unload it.” when you try to expand, view, or create Custom Views in Event Viewer. Additionally, the application may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs.

    SHA-2 Code Signing
    For Windows 7 Users, the SHA-2 Code Signing Support becomes mandatory in July. You will need to have KB4474419 (the SHA-2 update) and KB4490628 (2019-03 Servicing Stack) installed for Win7 SP1, Server 2008 R2 SP1, and Server 2008 SP2 prior to August updates.

    Martin Brinkman has his usual thorough summary posted on ghacks.

    Windows 7: 21 vulnerabilities: 1 rated critical and 20 rated important
    Windows 8.1: 19 vulnerabilities: 1 rated critical and 18 rated important
    Windows 10 version 1703: 24 vulnerabilities: 1 critical and 23 important
    Windows 10 version 1709: 36 vulnerabilities: 1 critical and 35 important
    Windows 10 version 1803: 37 vulnerabilities: 1 critical and 36 important
    Windows 10 version 1809: 36 vulnerabilities: 1 critical and 35 important
    Windows 10 version 1903: 36 vulnerabilities: 1 critical and 35 important

    Internet Explorer 11: 6 vulnerabilities: 6 critical
    Microsoft Edge: 7 vulnerabilities: 7 critical

    The Security Update Guide lists 1,854 new individual patches today.

    For those of you updating manually, there are new Servicing Stack Updates for all versions of Windows 10, Windows 8.1, and for Windows 8 Embedded.

    Updates are available for Microsoft Office MSI products: Office 2016, Office 2013, Office 2010, Office 2016 Language Interface Pack, and SharePoint Servers.

  • MS-DEFCON 2: Patch Tuesday beckons, make sure Auto Update is turned off

    Posted on July 8th, 2019 at 03:50 woody Comment on the AskWoody Lounge

    Tomorrow’s Patch Tuesday and you probably know what that means – it’s a good time to get Windows Automatic Update turned off.

    This month we have some fun ‘n games because those of you on Win10 version 1903 may witness a disappearing section in Update Options. But never fear. There are workarounds. (More like yelling at the Microsoft kids to get off the lawn, but nevermind.)

    One thing you should ponder: If Win10 1909 is going to be a Service Pack (with a different name) and it’s being distributed as a cumulative update (again, you have to wonder which bug fixes MS is holding back to beef up the 1909 cumulative update), how does that effect the “feature update deferral” setting. Will 1909 be a new “version” in the classic sense – thus allowing a feature update deferral? Or will it be a cumulative update – thus being put off by the “quality update deferral” setting? Will MS continue to release cumulative updates for 1903 after it’s delivered 1909? (There are parallels to Win7 and Win8, but I doubt that anybody’s thought about that.)

    I think it’s great that we’re finally getting some relief from the insane two-versions-a-year pace. But has anybody thought through how this is, you know, actually going to work?

    Anyway, details in Computerworld. Woody on Windows.