Latest IE6 (SP1) Security Update for Win 9x/ME

[dencorso]

Working fine here on 98SE!

That's wonderful news!

Thanks for the lightnig fast reaction to my post! You rock!

So we're back it the game, great!

And I'm sure WildBill will be happy, too, since this widens his updates user basis.

I am puzzled.......

I'm sure WildBill will be happy to solve this puzzle. I'll invite him over.

[WildBill]

Hey, all:

I tend to base the updates on the files currently installed on my system. I guess for some reason the newest patch to mshtmled wasn't installed on my PC for some odd reason. I'll see about reapplying the patch to the newer one, but I might wait for the next IE release first. I'm so backlogged with patches it isn't funny, to the point that I'm probably going to release my PE tool shortly and ask for help.

[Dave-H]

Hey, all:

I tend to base the updates on the files currently installed on my system. I guess for some reason the newest patch to mshtmled wasn't installed on my PC for some odd reason. I'll see about reapplying the patch to the newer one, but I might wait for the next IE release first. I'm so backlogged with patches it isn't funny, to the point that I'm probably going to release my PE tool shortly and ask for help.

Thanks Bill.

I'll probably put my original version of MSHTMLED.DLL back in that case.

It would be interesting to see what version of that file others have.

As I said, mine is 6.0.2800.1501.

Dave.

[dencorso]

@WildBill: The reason you didn't have KB896156 in your system is that it's a Hotfix (so one has to request it to get it), not a Security Update (which would be offered through Win Update and/or MS Update). Changing subjects, I might be able to help you, once you release the Tool, but you'd have to instruct me about your methods: I'm a programmer myself, I understand reasonably the PE exe format and I'm no stranger to creating patched files, but I saw some pretty complex segment reordering and expanding in your patches, the mechanics of which are not totally clear to me. I'm totally at home hexediting and reasonably confortable with IDA, although I sure have lots more to learn. And I'm very short of time, right now, but that's gonna change soon (I hope). Let's talk via PM about it.

@Dave-H: I use MSHTMLED.DLL v. 6.0.2800.1502 (the qfe branch file), from the same KB896156. Like MDGx, I do prefer the qfe branch files, because they include all mainstream fixes (the cumulative updates in the gdr branch) and all the less well tested fixes, too. It's more probable a qfe file will give problems than its gdr counterpart, and when I suspect such is the case, then I fall back to the gdr file and check whether that's the case or not. However, I've never been able to find any confirmed instance of problems due to my using qfe files: in the rare cases where I had problems with the qfe file, the gdr file also gave me the same problems, so I ended falling back to the previous version of the file. One such case was that IE update that gave rise to this thread. And whatever the reason it gave problems, it was fixed some later versions on, as we all know.

[dencorso]

I'll probably put my original version of MSHTMLED.DLL back in that case.

It would be interesting to see what version of that file others have.

As I said, mine is 6.0.2800.1501.

Sure. I did that, too, already.

But while you're at it, do also do update mshtml.dll once more. WildBill just correct a bug in it.

KB2360131-v2, which contains it, is in the same place the original one was.

[Dave-H]

I'll probably put my original version of MSHTMLED.DLL back in that case.

It would be interesting to see what version of that file others have.

As I said, mine is 6.0.2800.1501.

Sure. I did that, too, already.

But while you're at it, do also do update mshtml.dll once more. WildBill just correct a bug in it.

KB2360131-v2, which contains it, is in the same place the original one was.

Thanks Den, I've now got the new version.

As you rightly surmised, I had also installed KB896156 at some point, hence my later version of mshtmled.dll.

I'll probably stick with the version I've got rather than the 1502 version, as I've never had any problems with it.

[Prozactive]

I wanted to chime in and confirm that the KB2360131 updated system files seem to be working fine in Win98 SE, at least so far. Thank you WildBill for your excellent hard work in creating these Win2000 updates! And thanks dencorso for informing us about them and Dave-H for being the first guinea pig.

BTW, I also have the 6.00.2800.1501 version of MSHTMLED.DLL even though I don't remember installing the referenced Hotfix.

[dencorso]

BTW, I also have the 6.00.2800.1501 version of MSHTMLED.DLL even though I don't remember installing the referenced Hotfix.

It's part of MDIE6CU 3.4... that's probably how you and Dave got it.

Me, too. But I updated manually to the qfe branch afterwards, due to my preferring the qfe branch.

[Prozactive]

Yeah that's it... from MDIE6CU34E or earlier. Thanks again for letting us know about WildBill's work. I'm thinking about trying to implement some of the other updates too. And I admit I don't really understand the QFE/GDR branch issue you mentioned. I'll have to do some research and reading up on it b/c I've seen those terms around before.

[dencorso]

Look no farther than this: GDR, QFE, LDR...!

[Dave-H]

Look no farther than this: GDR, QFE, LDR...!

I did.

I now need to go and have a little lie down.

My brain hurts.

[dencorso]

Sorry for the indigestibly long explanation I pointed to. Here's what matters for our purposes:

GDR packages contain only security and critical stability issue fixes.

LDR packages contain "other" fixes that have not undergone as extensive testing, and resolve issues that only a fraction of the millions of Windows users might ever encounter.

What is not said above is that both those types are cumulative, so that a GDR file contains some new and all previous GDR fixes, while a QFE (= LDR) contains all that the GDR does, plus some new and all previous QFE fixes, being thus more completely fixed, but perhaps more prone to give problems, because less well tested.

Moreover, once a QFE file gets installed, all the future updates to it will always be taken from the QFE branch, too, automagically, from that point onwards (until the next official service pack, which, for 9x/ME, 2k and NT4 or older, will never be issued).

Hope this digests better.

[Dave-H]

Sorry for the indigestibly long explanation I pointed to. Here's what matters for our purposes:

GDR packages contain only security and critical stability issue fixes.

LDR packages contain "other" fixes that have not undergone as extensive testing, and resolve issues that only a fraction of the millions of Windows users might ever encounter.

What is not said above is that both those types are cumulative, so that a GDR file contains some new and all previous GDR fixes, while a QFE (= LDR) contains all that the GDR does, plus some new and all previous QFE fixes, being thus more completely fixed, but perhaps more prone to give problems, because less well tested.

Moreover, once a QFE file gets installed, all the future updates to it will always be taken from the QFE branch, too, automagically, from that point onwards (until the next official service pack, which, for 9x/ME, 2k and NT4 or older, will never be issued).

Hope this digests better.

So the QFE/LDR versions of files contain further fixes, which are not completely tested and now never will be completely tested, or officially issued for systems where support has ended?

That implies that MS have abandoned fixes in mid implementation because the systems they were intended for went out of support.

Seems a strange thing to do, but that's MS for you!

[dencorso]

Well, mostly, the QFE fixes work OK, but they were not deemed serious enough to undergo "full regression testing", whatever that may mean.

The QFE files for 98SE are the core of Gape's pack, for instance and the unofficial update packs for other versions of 9x/ME are based on them, as well, so I think they are very well tested by now and safe to use.

[jds]

Well, mostly, the QFE fixes work OK, but they were not deemed serious enough to undergo "full regression testing", whatever that may mean

I believe that means re-validating functionality that was previously validated in an earlier release. In other words, if a software provides functionality A, B, C, D, and a fix is required for functionality B, full regression testing would mean re-validating functionality A, C and D also.

Joe.