News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon

Blog Archives

  • Patch Tuesday patches are here

    Posted on January 8th, 2019 at 12:53 woody Comment on the AskWoody Lounge

    As usual, Martin Brinkmann has the first full list:

    • Microsoft released security updates for all client and server versions of Windows.
    • No critical vulnerabilities in Windows 8.1 and 7.
    • Microsoft released security updates for Microsoft Edge, Internet Explorer, Adobe Flash Player, .NET Framework, Microsoft Office, Microsoft Exchange Server, and Microsoft Visual Studio
    • The Update Catalog lists 187 updates for January 2019.

    Dustin Childs has an interesting take on the patches for the Zero Day Initiative:

    • CVE-2019-0547 – Windows DHCP Client Remote Code Execution Vulnerability
      If you are running Windows 10 or Server version 1803, this patch has to be on the top of your deployment list.

    • CVE-2019-0586 – Microsoft Exchange Memory Corruption Vulnerability
      This corrects a bug in Exchange that could allow an attacker to take control of an Exchange server just by sending it a specially crafted email.

    • CVE-2019-0550, CVE-2019-0551 – Windows Hyper-V Remote Code Execution Vulnerability

    Which means most of you aren’t in the crosshairs. The only known exploit he lists is for the Jet Database engine — another hole found in ancient technology that probably won’t affect you unless you use an old database application.

    There’s also a new Servicing Stack Update for Win10 version 1703, KB 4486458. As if any of you are still running 1703.

    There are January Security-only patches for .NET as well as the Security and Quality Rollups.

    January 2019 Security Updates for Microsoft Office 2010, Office 2013, Office 2016, the Office Viewers, and SharePoint Servers are available on the Office Support Pages. These Updates are for the .msi versions of Office, not Office 365 or C2R.

    UPDATE: It looks like the Win10 version 1803 patch, KB 4480966, may be something you need to install quickly. So far there are no known exploits, and no proof of concept code. But Microsoft is saying it’s bad.

    Will keep you posted as the drama unfolds.