• October 2019 Patch Tuesday – watch out

    Home » Forums » Newsletter and Homepage topics » October 2019 Patch Tuesday – watch out

    Author
    Topic
    #1977062

    The patches just hit. I count 132 new patches in the Update Catalog — added to the 50 that were released on Oct. 3rd (and updated on the 4th).
    [See the full post at: October 2019 Patch Tuesday – watch out]

    5 users thanked author for this post.
    Viewing 23 reply threads
    Author
    Replies
    • #1977069

      The 2019-10 Security-only Update and IE11 Cumulative Update have been added to AKB2000003  for Group B patchers (and anyone else who needs them).

      NOTE: The links in AKB2000003 are direct download links to the MS Update Catalog.

      See #1977137 for prerequsites for the October patches for Win7 and the SSU for Win8.1.

      5 users thanked author for this post.
    • #1977067

      ? says:

      Eye, eye Captain. can’t wait to see what’s inside!

    • #1977077

      Seeker (cannon fodder) report:

      Cumulative Update for Windows 10 Version 1903 for x64-based Systems (KB4517389)

      plus signature update for Defender, and the Malicious Software Removal Tool.

      HP Officejet Pro 8600 network printer printing same as always.

      For me “watch out” is equivalent to “have a current drive image available”, which I always have.

      Before –

      1903-388

      After –

      1903-418

      Always create a fresh drive image before making system changes/Windows updates; you may need to start over!
      We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.
      We were all once "Average Users".

      • This reply was modified 5 years, 6 months ago by bbearren.
      • This reply was modified 5 years, 6 months ago by bbearren.
      2 users thanked author for this post.
    • #1977095

      woody & others: I’m gonna wait til at least October 15 (3rd Tuesday) to actually patch my computers and will not download nor install these new security updates

      too much patch info on my brain (patch info overload) since MS has released a bunch of problematic patches the past few weeks 🙁

      2 users thanked author for this post.
      • #1977150

        Same here for my Win 10 PC – I only got my Win 8.1. laptop updated as it’s much easier to roll back  in case I need to to so.

    • #1977133

      For the IE 11 Oct 2019 update(KB4519974) or the Windows Security Only Update for Oct 2019 is there any latest SSU update version dependencies  on any SSU KB that was maybe was reissued in September 2019? And ditto for any SHA-2 KBs that have the same KB number but are a newer version/reissue.

      It’s really been hardest keeping track of what is the latest SSU/Other reissued KB updates if they keep using the exact same KB number without including the month or some version numbering so folks can make sure to have the latest.

      That and all these issues with patches breaking things is sure not helping matters as far as KBs are concerned.

       

       

      • #1977137

        For Win7 prerequsites:

        1. The March 12, 2019 servicing stack update (SSU) (KB4490628). If you are using Windows Update, this SSU will be offered to you automatically. To get the standalone package for this SSU, search for it in the Microsoft Update Catalog.
        2. The latest SHA-2 update (KB4474419) released October 8, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically. For more information on SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
        3. The latest SSU (KB4516655). If you are using Windows Update, the latest SSU will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the Microsoft Update Catalog.

        For Win8.1:

        If you are using Windows Update, the latest SSU (KB4521864) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the Microsoft Update Catalog.

        3 users thanked author for this post.
        • #1977148

          I already installed the KB4474419 that came to me on WU.  No problems.  I went to the MS Update Catalog and got the KB4516655 and have it saved and ready to install; is it okay to install it or are we still in the update lockdown for this too?

          Being 20 something in the 70's was far more fun than being 70 something in the insane 20's
    • #1977180

      Installed 2019-10 Cumulative Update for Windows 10 Version 1903 for x64-based Systems (KB4517389)

      Key changes include:

      Addresses an issue with applications and printer drivers that utilize the Windows JavaScript engine (jscript.dll) for processing print jobs.

      This printer fix is also included with today’s updates for 1809, 1803, 1709, 1703, 1607, 8.1, 7.

      3 users thanked author for this post.
      • #1977200

        One data point here, but one particular Windows 8.1 system with a Type 4 Ricoh printer driver that was crashing when trying to print with the previous IE11/JScript patch installed, seems to be fine now with today’s 10/8/19 KB4520005 set installed.   I was a bit hopeful when I read the “Addresses an issue with applications and printer drivers that utilize the Windows JavaScript engine (jscript.dll) for processing print jobs.”.  Just really annoying they didn’t list this particular bug as a known issue last week.

         

         

         

        1 user thanked author for this post.
    • #1977201

      Hello Susan,

       

      Thank you for the information.

       

      This patch KB4524147 update contains not only for IE, it as a update for other components.

       

      We have received an update yesterday that the issue has been fix on the latest  KB4517389.

      https://docs.microsoft.com/en-us/windows/release-information/status-windows-10-1903#351msgdesc

       

      We suggest you to install the Oct 8th patch and let us know the status.

       

      Please let us know the if you have any concerns or queries.

       

      From the support case I opened.  Testing now and I think the October 8th patches have indeed fixed it up.

      Susan Bradley Patch Lady/Prudent patcher

    • #1977202

      Intermittent issues when printing

      Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
      • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
      • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
      Affected platforms:
      • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
      • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

      from https://docs.microsoft.com/en-us/windows/release-information/status-windows-10-1903#351msgdesc

      Susan Bradley Patch Lady/Prudent patcher

      2 users thanked author for this post.
      • #1977218

        Status: Resolved KB4517389

        History: Resolved: October 08, 2019 10:00 AM PT

        1 user thanked author for this post.
    • #1977248

      So what exactly does changing permissions to jscript.dll break?  I read through the MS fluff and it seemed to imply that IE11 uses a different jscript9.dll engine by default, therefore changing permissions should only break a few things.

      Is this correct?  Is there an easy way to check some sites to see which engine they use before I start modifying things?  I’m asking as IT for a medium business, not as a single user.

    • #1977260

      It’s good that all .NET updates are from last month, which are already installed 🙂

      1 user thanked author for this post.
      b
      • #1977288

        Yes for me on one Windows 7 machine, but not on the other as I always leave a day or two between updating the two machines during which time we were advised not to install any September updates as opposed merely to the out of band ones, and so the .net framework update never got to be installed on the second machine!

    • #1977264
      2 users thanked author for this post.
      woody, b
    • #1977284

      KB4519338 build number for this CU 17763.806 or 17763.805?

      Winver-After-Installing-KB4519338

      • This reply was modified 5 years, 6 months ago by Sailor.
      • This reply was modified 5 years, 6 months ago by Sailor.
      • #1977306

        805 was the first build.  806 is an updated version released a few hours later with the following note:

        Note This release also contains updates for Microsoft HoloLens (OS Build 17763.806) released October 8, 2019. Microsoft will release an update directly to the Windows Update Client to improve Windows Update reliability on Microsoft HoloLens that have not updated to this most recent OS Build.

        2 users thanked author for this post.
    • #1977289

      Help. I cannot uninstall KB4517389 because it does not appear in my “Installed Updates” list after a reboot.

      I just opened the box on a Dell Optiplex 7060 Micro, configured Windows 10 1903 (OS Build 18362.175 – June 11, 2019) and clicked “Check for Updates” (I wanted to install OS build 18362.388 – October 3, 2019). Windows Update just installed the following:

      • 2019-10 Cumulative Update for Windows 10 Version 1903 for x64-based Systems (KB4517389)
      • 2019-09 Security Update for Adobe Flash Player for Windows 10 Version 1903 for x64-based Systems (KB4516115)
      • 2019-10 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 Version 1903 for x64 (KB4524100)

      I have been reading Susan Bradley’s Master Patch List, where she recommends to “Never install an update to a newer version of .NET.” The latest patch list says OS build 18362.388 – October 3, 2019 is safe to install, but Woody says to “Defer” on today’s KB4517389. How can I uninstall it if it does not appear in my “Installed Updates” list? Windows also reports that I am still running OS Build 18362.175 – June 11, 2019. Please advise, thanks.

      • This reply was modified 5 years, 6 months ago by Jon.
      • #1977299

        This may sound silly, but try checking for updates again. There have been incidents where the CU (supposedly) installs twice at least as recorded in the History, but maybe just didn’t finish the first time. If it shows up again, install it again.

        (It’s happened to me)

        1 user thanked author for this post.
      • #1977300

        I owe everyone an apology.  I didn’t see widespread issues with the out of band IE and said to install it… and yet there were still issues with printing.  I’m going to change that “install” to defer and recommend waiting for the October updates to settle down.

        Susan Bradley Patch Lady/Prudent patcher

        2 users thanked author for this post.
      • #1977303

        The version you see with the “winver” command is the version you are running.

        Currently the bug with the cumulative updates showing twice is due to this:  the cumulative updates are silently packaged with the Servicing Stack Updates.  They’re supposed to install at the same time, but in certain circumstances, such as the system being too far behind on CU updates and missing certain Servicing Stack prerequisites, they do not.  The servicing stack update will report that it’s installed as the CU, and then during the actual CU update, the same update will show as having installed twice, with a (2) listed in the Windows Update History.

        To verify what actually made it into the system, go to the “C:\Windows\servicing\Sessions” directory, and read the numbered XML docs that have today’s timestamp.  Near the top will be a line similar to the following:

        <Phase seq=”1″>
        <package id=”Package_for_KB4521863~31bf3856ad364e35~amd64~~18362.411.1.3″ name=”KB4521863″ targetState=”Installed” options=”17″/>
        </Phase>

        That tells you what actually installed.  My guess is that in one of those files, you’ll see the KB4521863 number I just pasted, because that’s the servicing stack update from today.  Were you to reboot and check again, you’d indeed see KB4517389 available to install (“again”) and that is what you want to hold off on doing.

        3 users thanked author for this post.
        • #1977974

          The version you see with the “winver” command is the version you are running.

          Currently the bug with the cumulative updates showing twice is due to this:  the cumulative updates are silently packaged with the Servicing Stack Updates.  They’re supposed to install at the same time, but in certain circumstances, such as the system being too far behind on CU updates and missing certain Servicing Stack prerequisites, they do not.  The servicing stack update will report that it’s installed as the CU, and then during the actual CU update, the same update will show as having installed twice, with a (2) listed in the Windows Update History.

          To verify what actually made it into the system, go to the “C:\Windows\servicing\Sessions” directory, and read the numbered XML docs that have today’s timestamp.  Near the top will be a line similar to the following:

          <Phase seq=”1″>
          <package id=”Package_for_KB4521863~31bf3856ad364e35~amd64~~18362.411.1.3″ name=”KB4521863″ targetState=”Installed” options=”17″/>
          </Phase>

          That tells you what actually installed.  My guess is that in one of those files, you’ll see the KB4521863 number I just pasted, because that’s the servicing stack update from today.  Were you to reboot and check again, you’d indeed see KB4517389 available to install (“again”) and that is what you want to hold off on doing.

          Hi Anonymous,

          Good call. The KB4521863 SSU from October 8th was indeed installed. I opened the XML files, did a “Ctrl+F” search for keyword “Installed” and found the following packages installed:

          Package~31bf3856ad364e35~amd64~~10.0.18362.1″ name=”Windows Foundation” targetState=”Installed”

          <package id=”Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.18362.1″ name=”Windows Foundation” targetState=”Installed” options=”5″/>

          <package id=”Package_for_KB4521863~31bf3856ad364e35~amd64~~18362.411.1.3″ name=”KB4521863″ targetState=”Installed” options=”17″/>

          <package id=”Package_for_KB4516115~31bf3856ad364e35~amd64~~10.0.1.0″ name=”KB4516115″ targetState=”Installed” options=”0″/>

          <package id=”Package_for_DotNetRollup~31bf3856ad364e35~amd64~~10.0.1.3012″ name=”KB4515871″ targetState=”Installed” options=”0″/>

          <package id=”Package_for_RollupFix~31bf3856ad364e35~amd64~~18362.418.1.9″ name=”KB4517389″ targetState=”Installed” options=”17″/>

          This may sound silly, but try checking for updates again. There have been incidents where the CU (supposedly) installs twice at least as recorded in the History, but maybe just didn’t finish the first time. If it shows up again, install it again.

          (It’s happened to me)

          Thanks PKCano. I checked for updates a second time and KB4517389 began installing again. Now to roll back to September 10th – OS Build 18362.387 (KB4517211).

          • This reply was modified 5 years, 6 months ago by Jon.
          • This reply was modified 5 years, 6 months ago by Jon.
      • #1977448

        .NET 3.5 and 4.8 are inbox components of Win10 1903

        WU will always offer the latest patch tuesday CU

        if you are on 18362.175, then KB4517389 is not installed yet

        1 user thanked author for this post.
    • #1977302

      I havent updated since august. Didnt update sept and looks like oct as well. All is up and running well. When im safe theres no bugs, then i update again

      • #1977396

        I skipped the July 2019 Windows 7 Security Only patches because of Telemetry and the September patches as well for the same reason as July. And the way things are going I may just give up for longer if more telemetry and  outright breakage by improperly vetted KBs continues.

        There are only 3 more months of patches remaining for Windows 7 after Oct 2019 anyways but I sure hope that by the end of October 2019 that there will be at least a DEFCON3 for Oct without waiting for November to roll around before it’s safe to install the Oct KBs.

        I’m beginning to suspect that there are not many humans directly involved in MS’s vetting process for KBs and that MS is just trying to train its AI more on the backs of the end users when more humans is really what is needed to be involved in vetting the KBs rather than less.

        Who would have thought that skipping any telemetry related patches in Windows 7’s supposed Security Only KBs has saved me from so much other KB related QA/QC pain and suffering. So with only 3 months remaining after Oct 2019 it becomes very tempting to just give up doing any more Windows 7 updating!  I may only be considering the IE related patching because of that zero day issue and as soon as that’s fixed, along with the other IE issues, just declare Windows 7’s EOL for me has already occurred.

        • #1977449

          Oh, I’m sure there will be a few more “zero day issues” for Windows (and, especially Windows 7) before the end of this year and continuing into next year.

          In fact, I wouldn’t be surprised if MS and it’s ‘security mates’ are stockpiling a few right now as we speak.

          So, after W7 patching “officially” ends in January I’m sure that from February forward, we’ll be seeing ongoing announcements like “Another major zero day security issue for Windows this month. As Windows 7 is no longer being provided with security updates, you must upgrade to Windows 10 immediately to stay safe”.

          Would not surprise me at all.

          As I said a week or so back – if you’re using Windows 7 you’d better hang on to your seats as I’m pretty certain MS is going to make it as bumpy a ride as possible until January – and, as I’ve stated above – probably continuing into February and beyond.

          1 user thanked author for this post.
          • #1977763

            Maybe so but MS in the past has issued updates for XP and that’s some years after that OS’s EOL(1). And MS will still be Supporting Windows 7 with paid for Security Updates for Enterprise, SMBs, and Volume licensing customers until 2023.

            “Windows XP SP3 x86 | 4500331 | Security Update | Remote Code Execution | Critical
            Windows XP Professional x64 Edition SP2 | 4500331 | Security Update | Remote Code Execution | Critical” (1)

            So that XP patch in May 2019 includes not just the Point OF Sale version of XP but included the other editions as well on 32/64 bit versions of XP.

            (1)

            “Customer guidance for CVE-2019-0708 Remote Desktop Services Remote Code Execution Vulnerability: May 14, 2019”

            https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708

          • #1977858

            You are so right CarlD.

            Being 20 something in the 70's was far more fun than being 70 something in the insane 20's
        • #1977820

          Win7Pro-64, Group B since the GWX incident, WU for Office and .NET, running on i7-960 CPU, Intel DX58SO2 motherboard, 12GB RAM, nVidia GTX 660Ti GPU, WD Black HDD, ethernet and no wireless or bluetooth.

          I have judiciously avoided the telemetry of the past and removed patches that had already been installed, as well as disabling any of the remaining telemetry tasks. I also check both the tasks and WU settings after any patch session to ensure that tasks are not re-enabled and my WU settings are still on the never check.

          However after reading Abbodi86’s past posts and the posts of others on how to disable the telemetry, I have installed the recent Security-Only patches with the telemetry. After install and again after the reboot, I checked my disabled tasks and only one was enabled, and that was with the first July SO patch with the telemetry components. I again disabled the task and the triggers in Task Manager and subsequent SO patches with telemetry have NOT re-enabled it and have respected the settings. By disabling the trigger events also, the scans are not run at all. I have also checked the telemetry related folders with telemetry data have not been recreated or changed since the GWX period. In addition, many of the subsequent telemetry-related non-security patches have not presented themselves in WU, so I know the original is not acting as a pre-requisite.

          Given the security holes the SO patches with telemetry address, I do not believe it is still prudent to skip them altogether just to avoid the telemetry, when that can be accomplished by task manager. This is especially true for Group B that does not receive cumulative patches, or any of those who might want to run Windows 7 past EOL. I based this decision on the reporting on this site and other sites and the extremely helpful posts by members who report monthly of their experiences with these issues. Many thanks to both the early patching canaries in a coal mine and the later postings of those who are more cautious.

          As always, just my experiences and opinions, so YMMV.

          PS: All the September Group B patches and the Office patches installed fine on the Lenovo E440 Thinkpad laptop and the DYI desktop. Just in time for the DefCon1 to be issued 2 days later.

    • #1977382

      KB4474419 (From September)  isn’t showing up on my Windows Update list. Only the Monthly October Rollup and MSRT are there. Did they remove it or are they going to introduce an October version of KB4474419?

      • #1977385

        The last two versions of KB4474419 showing in the Catalog for Win7 are dated 8/12 and 9/9. There doesn’t seem to be an Oct version except for Server 2008.

        • #1977389

          But shouldn’t KB4474419 still be offered in windows update if it says it is needed for the October Monthly Rollup? I only have the one from August installed, don’t I need the September one as well?

      • #1977487

        As I recall it only shows up if you hide or install updates.  It wants to be installed all by itself.

        Susan Bradley Patch Lady/Prudent patcher

        1 user thanked author for this post.
        • #1977716

          You do that for the SSU to be installed by itself. KB4474419 showed up before along with the September Monthly Rollup.

    • #1977388

      Does installing the latest SSU require you to have already installed the SSU previous to it?   Or is each SSU cumulative, like the normal windows updates are cumulative?

      I have confirmed on two Win 7 virtual machines that the latest Win 7 SSU 4516655 does not install unless the previous SSU 4490628 is already installed.

      Interestingly, I found out because these two Win 7 vm’s did not pick up 4490628 or 4516655 from Windows Update (these were test vm’s, not joined to a domain).  I had to download both SSUs from MS catalog and perform manual installs for both.  And as I mentioned, 4516655 would not install until I first installed 4490628.

      Conversely, our domain Win 7 clients did not have this problem and found both SSUs through WSUS.

      The SSU page for 4516655 says it “replaces” 4490628, which leads me to believe we shouldn’t need a previous SSU to install the latest SSU.  But I could be wrong.  Just looking for clarification.

       

    • #1977536

      Still W7 here, and wondering: I had expected the 3 october patch for IE, KB4524157 (https://support.microsoft.com/en-us/help/4524157) to be replaced by the monthly rollup, but as far as I can see it is not incorporated in KB4519976 (https://support.microsoft.com/en-us/help/4519976). Last time I chekec (this weekend), the IE patch was unchecked. MS does not make things easy for the mainstream computer user!

      ~Annemarie

    • #1977551

      Not patch related
      https://support.microsoft.com/en-us/help/4522904/potential-disruption-to-microsoft-services-in-chrome-beta-version-79

      Chrome gets a handy third-party cookies clearing option

      Google implemented a new experimental feature in Chrome Canary that gives users options to clear third-party cookies in the web browser…..

      https://www.ghacks.net/2019/10/06/chrome-gets-a-handy-third-party-cookies-clearing-option/

    • #1977571

      My machines updated as follows:

      A desktop & laptop on the Win 10 Fast Ring at 18995, no problems;

      A desktop, two laptops at Win 10 1909, updated manually with all updates on the Master List except .Net 4.8, then October CU and SSU updates done manually on Oct 8<sup>th</sup>, no problems;

      A desktop, Netbook, Surface Pro 3 and Laptop at Win 10 1903, updated manually with all updates on the Master List except .Net 4.8, then October CU and SSU updates done manually on Oct 8<sup>th</sup>,  no problems;  printers are Brother, Epson, Samsung.  IE 11 uninstalled on all computers, as well as Flash player.

    • #1977574

      October 2019 Patch Tuesday is the last update for Windows 1703 which just EOLed.

      1 user thanked author for this post.
    • #1977584

      So the IE vulnerability is included on the cumulative octobrr update? I update my win10 1903 few minutes ago

      1 user thanked author for this post.
      • #1977683

        Yes – but I wouldn’t recommend installing it just yet!

        • #1977688

          Why is there no clear communication from MS whether the IE security updates are incorporated in the monthly rollups? There is no indication that the IE-updates are, if you have to rely on the documentation MS supplies.

          • #1977699

            The IE11 Cumulative Updates are always one of the components of the Monthly Rollup.

    • #1977668

      KB 4517389, SSU, MSRT inst’d and HP Print, Start all OK…. Slow CU Install – Fast Re-start.

      Ref PKC and CU dbl install and History entries…. I DID watch the CU go thru 2 install % cycles but Only 1 instance of install is in History.  18362.418

      W10 Pro 22H2 / Hm-Stdnt Ofce '16 C2R / Macrium Pd vX / GP=2 + FtrU=Semi-Annual + Feature Defer = 1 + QU = 0

      • This reply was modified 5 years, 6 months ago by CraigS26.
    • #1977834

      Group A, except I don’t take previews nor .net down loads as a home user.  Took KB4519976 and the MSRT  updates.  Win7x64,  Home Premium, AMD.  HP1112 printer. No problems.

      2 users thanked author for this post.
    • #1984544

      Confirmed KB4515871 .NET update sometimes breaks KeePass. Uninstall is the fix.
      https://sourceforge.net/p/keepass/discussion/329221/thread/93f3868023/

      cheers, Paul

      3 users thanked author for this post.
    Viewing 23 reply threads
    Reply To: October 2019 Patch Tuesday – watch out

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: