Microsoft slates record-setting monster Patch Tuesday next week

14 updates, 8 critical, will quash 34 bugs in Windows, Office, IE, Silverlight

Microsoft today said it will deliver a record 14 security updates next week to patch a record-tying 34 vulnerabilities in Windows, Internet Explorer (IE), Office and Silverlight.

But people still running Windows XP Service Pack 2 (SP2) will receive only a few of those fixes.

"Call it Massive Patch Tuesday," said Wolfgang Kandek, CTO of security risk and compliance provider Qualys. "It's a huge update, and more importantly, everybody's involved. I'm actually a little surprised at how large it is."

Eight of the 14 updates were tagged with Microsoft's "critical" label, the highest threat ranking in its four-step scoring system. The remaining six were marked "important," the second-highest rating.

Next week's Patch Tuesday will be a record on several fronts.

The 14 updates -- Microsoft dubs them "bulletins" -- are a record, beating the count from both February 2010 and October 2009 by one. The 34 individual patches equals the single-month record, which was first set last October and repeated in June 2010. And the eight critical updates next week will also tie the record set in October 2009.

Microsoft has been shipping alternating large and small batches of fixes, with the larger-sized updates landing in even-numbered months, so the month's big numbers shouldn't have come as a complete shock. In July, for example, the company issued just four bulletins that patched five vulnerabilities. June's collection, however, amounted to 10 bulletins that fixed 34 flaws .

IE is also patched on an every-other-month schedule. Microsoft last fixed IE flaws in June.

"This is big, not only because of the numbers, but also because they'll affect everybody," said Kandek, referring to next week's lineup.

According to Microsoft's monthly advance notification, the company will deliver 10 updates for Windows, half of them critical, the other five rated important. Two updates will patch one or more critical bugs in IE and Silverlight, while another pair affect Office.

All currently-supported versions of Windows are impacted by multiple updates, Microsoft said, with Windows XP Service Pack 3 (SP3), the oldest edition that receives patches, affected by all five Windows-only critical updates, as well as by the critical IE and Silverlight fixes.

Nor will Windows 7 escape next week: Two of the five critical Windows updates apply to the newest operating system, as do the critical IE and Silverlight patches. Windows 7 will receive at least 10 of the 14 planned updates.

The Office updates are aimed at flaws in Word and Excel, and affect all versions of the word processor and spreadsheet with the exception of those in Office 2010. Both updates also apply to the Mac editions of Word and Excel, said Microsoft.

"A large month was expected," said Kandek, "but my main worry now is for Windows XP SP2 users who haven't upgraded."

Last month, Microsoft retired Windows XP SP2 and Windows 2000 from "extended support," which means security patches will no longer to crafted or supplied for those operating systems.

Microsoft made that clear earlier this week when it released an emergency, or "out-of-band" update , to quash a critical bug in Windows shortcuts that hackers have already used to hijack PCs, including machines in multiple companies that oversee important industrial control systems. It did not provide a patch then for XP SP2.

Although Microsoft's policy prevents it from confirming whether unsupported software contains vulnerabilities, it's likely that XP SP2 harbors the same bugs as XP SP3, which will be patched next week.

"All of those for XP SP3 are quite probably also in XP SP2," said Kandek.

Not only will Microsoft not offer the applicable Windows updates to PCs running XP SP2, but it will also deny those machines the critical IE update .

The Office updates may be delivered to users running Windows XP SP2, however; Microsoft evaluates Office's patching needs using the version of the suite running on the system, not on the operating system.

"There's no free pass just because Windows Update doesn't offer you patches," said Kandek, talking to XP SP2 users, who might think they're safe because they won't see any updates offered on Tuesday.

Qualys has offered users of obsolete operating systems a hand by testing some exploits against out-of-support versions of Windows. The company publishes the results on its Web site.

"We'll continue to do this to substantiate our suspicion that [XP SP2] is very vulnerable now that it's not being patched," said Kandek."

Microsoft will release the 14 updates at approximately 1 p.m. ET on Aug. 10.

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags MicrosoftsecurityWindowssoftwareoperating systems

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?