Like it or not, here are ALL your October Microsoft patches (Rolled-up Windows Update)

The Register ^ | Oct 11, 2016 | Shaun Nichols

[dayglored]

Microsoft is kicking off a controversial new security program this month by packaging all of its security updates into a single payload.

The October security release introduces Redmond's new policy of bundling all security bulletins as one download. While more convenient for end users, who now get just one bundle, the move will irk many administrators, who had preferred to individually test and apply each patch to avoid compatibility problems.

In total, ten bulletins have been bundled into the Patch Tuesday payload:

• MS16-118 is a cumulative update for Internet Explorer to address 11 security vulnerabilities, including six remote code execution flaws, three information disclosure vulnerabilities, and two elevation of privilege conditions.
• MS16-119 will fix 13 CVE-listed vulnerabilities present in the Edge browser. Those flaws include eight remote code execution holes, two information disclosure flaws, two elevation of privilege holes, and one security feature bypass.
• MS16-120 addresses seven flaws in the Microsoft Graphics Component in Windows (and used by Skype and Office) that would allow remote code execution, elevation of privilege, or information disclosure by opening a web page or document containing a malformed image or font.
• MS16-121 will fix a single remote code execution flaw in Office related to problems with the handling of RTF document files. The flaw has also been patched in Office for Mac, so OS X and macOS users should be on the lookout for an update as well.
• MS16-122 patches a remote code execution flaw in the Windows Video Control that can be exposed with files embedded in a web page or email document.
• MS16-123 is a patch for five CVE-listed vulnerabilities in Windows Kernel Mode Drivers that allow elevation of privilege when the user runs a locally installed application.
• MS16-124 patches four vulnerabilities in Windows that could potentially allow local applications to view registry information.
• MS16-125 is an update to address an elevation of privilege flaw in the Windows Diagnostic Hub related to the handling of insecure library data. That flaw could potentially be targeted via a locally installed application.
• MS16-126 cleans up an information disclosure flaw in the Windows Internet Messaging API for Internet Explorer that Microsoft has also addressed with the above . Both bulletins will need to be installed (not a problem anymore) for the vulnerability to be fully patched.
• MS16-127 patches twelve vulnerabilities in Flash Player for Windows 8.1, Windows 10, and Server 2012.

For those not yet getting their Flash Player fixes directly from Microsoft, Adobe has posted its own fixes for twelve remote code execution flaws in Flash.

Adobe has also posted code clean-ups for 71(!) CVE-listed security holes in Acrobat and Reader, as well as a fix for a single elevation of privilege vulnerability in Creative Cloud.

[Note: Article has individual links for each bulletin.]

[dayglored]

The alert reader will note that these 10 bulletins actually cover fixes for 11+13+7+1+1+5+4+1+1+12=56 separate vulnerabilities.

Well, ya was warned. SO OPEN WIDE!! HERE THEY COME!!

[dayglored]

Patch Tuesday, now ONE BIG PILE! ... PING!

You can find all the Windows Ping list threads with FR search: just search on keyword "windowspinglist".

[\/\/ayne]

We hates it!

[Bob]

Can you suggest a way to keep this from downloading when I’m tethered to my phone? It sounds like I’d be blowing through most of my data just to download these patches. (Sorry for the dumb question — I never had to worry about this with Windows 7.)

[smokingfrog]

Nice of MS to make things so easy for us. /s

[doorgunner69]

I never had to worry about this with Windows 7

Nor have I, no MS Win 7 patches downlaod in over two and a half years, and no issues at all. The Nvidia graphics card, sure, MS, never.

[publius911]

Bookmark

[matthew fuller]

This is what MS wants me to install-

October, 2016 Security and Quality Rollup for .NET Framework 3.5.1 on Windows 7 SP1 (KB3188740)

Download size: 4.1 MB

Update type: Important

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.

More information:
http://support.microsoft.com/kb/3188740

Help and Support:
http://support.microsoft.com

October, 2016 Security Monthly Quality Rollup for Windows 7 (KB3185330)

Download size: 72.0 MB

You may need to restart your computer for this update to take effect.

Update type: Important

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.

More information:
http://support.microsoft.com/kb/3185330

Help and Support:
http://support.microsoft.com

Update for Windows 7 (KB3182203)

Download size: 336 KB

You may need to restart your computer for this update to take effect.

Update type: Important

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.

More information:
http://support.microsoft.com/kb/3182203

Help and Support:
http://support.microsoft.com

Windows Malicious Software Removal Tool - October 2016 (KB890830)

Download size: 3.4 MB

You may need to restart your computer for this update to take effect.

Update type: Important

After the download, this tool runs one time to check your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection that is found. If an infection is found, the tool will display a status report the next time that you start your computer. A new version of the tool will be offered every month. If you want to manually run the tool on your computer, you can download a copy from the Microsoft Download Center, or you can run an online version from microsoft.com. This tool is not a replacement for an antivirus product. To help protect your computer, you should use an antivirus product.

More information:
http://support.microsoft.com/kb/890830

Help and Support:
http://support.microsoft.com

As a die-hard bitter clinger to windows 7, should I install these?
Thanks.

[Bob]

With Windows 7, I could check for updates when on wifi and download them “free”. With 10, I’ve had a couple of days when 600 megs downloaded while I was tethered to my phone — that’s several days worth of my typical usage.

[hsmomx3]

My Win 10 computer had just five updates.

[doorgunner69]

Yet another reason I refuse to "upgrade" to 10.

This is MY computer, not theirs to take over whenever they want to "upgrade" some damn thing I did not ask for.

[Fresh Wind]

I’ve always wondered about those “malicious software removal tools” that MS is always pushing. What do they actually do that I can’t do with a good anti-virus program, and something like MalwareBytes?

[Drago]

There is a “metered connection” setting in Windows 10. See: http://www.groovypost.com/howto/manage-windows-10-data-usage/

I know longer have to worry about Windows hassles...went Mac about 4 years ago (hassling with Windows became too much after 20 years...at my age you just want it to work, no tinkering needed).

[thinden]

BBB

[thoughtomator]

There’s only one reason to do this and that is to force acceptance of patches that would otherwise be roundly rejected by end users.

[BraveMan]

If I wrote code this bad I’d soon be the Walmart Angry Greeter!

[Bob]

Thanks, that metered connection setting sounds like exactly what I was looking for.

[DAC21]

Wonder if one will fix the major 10.1 updated that rolled out to tablets a few weeks back. My Asus tablet has been bricked since. I haven't been able to figure out how to start in safe mode to uninstall the update. Suckey OS freezes 15 seconds after booting, not enough time to get into system to roll back.

[upchuck]

Win 7 BUMP. Have Win updates completely turned off. No problems.

[rockrr]

Bob - do yourself a favor and configure your tethered connection as “metered”. That way when you are connected to your phone you won’t experience patching downloads.

http://www.pcworld.com/article/2953132/windows/set-windows-10s-wi-fi-connections-as-metered-to-download-forced-updates-at-your-own-pace.html