• Microsoft clarifies (?) its CVE-2019-1367 release method

    From the Windows Message Center:

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.)

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions, IT admins using WSUS can import this update into WSUS/SCCM manually. See instructions on the WSUS and the Catalog Site.

    For those of you who don’t speak, you know, insider hep talk, “9C” is shorthand for “the third week in September that includes a Tuesday.”

    This seems to imply that the second monthly cumulative update for Win10 1903 is scheduled to arrived on Sept. 26 (tomorrow), and that it will include the fix for CVE-2019-1367.

    You have to wonder if MS could come up with a Cortana translator for this stuff. I mean, it’s cool that the cognoscenti can all use their own language and all… but some normal people have to understand this, too.

    Thx @teroalhonen