IE11 cumulative security updates question

[krose]

I was building a new image of Windows 7 HP 64 bit. I am confused about IE11 cumulative security updates. In 8/14 there was update KB2976627. It was superceded by KB2977629 in 9/14, except for IE11. Each cumulative update always replaces the previous, except in this case. Anybody know why?

Now onto the lastest issue. I added the February updates to my image with DISM, but after install WU still wants IE11 cumulative security update KB3021952. Checking installed updates, KB3021952 is listed. The WU update must be some smaller component of KB3021952 because the download is only listed as 5-6 MB. Can anybody help me straighten this out? TIA.

[Glenn9999]

Your first question, they probably was just late on getting it out when you looked at it.  Or they felt they didn't need to update IE11 that month for some reason.  I'm sure there's a legit reason.

 

On your second question, Microsoft often bundles updates.  For instance, Win8.1 x64 3021952 also has 3023607 and 3036197.  It just seems in this case that you are missing one of the "other" updates if you show 3021952 installed.

 

 

I was building a new image of Windows 7 HP 64 bit. I am confused about IE11 cumulative security updates. In 8/14 there was update KB2976627. It was superceded by KB2977629 in 9/14, except for IE11. Each cumulative update always replaces the previous, except in this case. Anybody know why?

Now onto the lastest issue. I added the February updates to my image with DISM, but after install WU still wants IE11 cumulative security update KB3021952. Checking installed updates, KB3021952 is listed. The WU update must be some smaller component of KB3021952 because the download is only listed as 5-6 MB. Can anybody help me straighten this out? TIA.

Title: Cumulative Security Update for Internet Explorer 11 for Windows 8.1 for x64-based Systems (KB3021952)KB IDs: 3021952 Security Bulletin IDs: MS15-009 Date Issued: 2015-02-10Installed: TRUEHidden: FALSECategories: Security Updates, Windows 8.1, MSRC Severity: CriticalListing of Files: windows8.1-kb3021952-x64 - windows8.1-kb3021952-x64_ec6b557f24c7677460253d5fa08ec26acaae279a.cab (51874 KB)windows8.1-kb3023607-x64 - windows8.1-kb3023607-x64_749da24d6f5b99697e408a690acda5516fc8c5e3.cab (391 KB)windows8.1-kb3036197-x64 - windows8.1-kb3036197-x64_251b1867a07951f96e4f7badbf7c11a5193018f1.cab (1334 KB)Description: A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.

Edited February 13, 2015 by Glenn9999

[krose]

I think MS doesn't know what the hell it's doing half most of the time. A cumulative update is just that, it should supercede all previous updates. As it stands now I have five IE11 updates, KB2909210, KB2929437, KB2976627, and now KB3021952 and KB3034196. I add them all to a base image containing only IE11 and it says I still need KB3021952. I updated my laptop by WU and it doesn't need KB3021952 a second time, but it also doesn't install KB3034196. You have to run WU twice to install KB3034196. Some dependency on KB3021952?  Strange things at Redmond to be sure. How about rolling them into one update? Oh there I go making sense.

Edited February 14, 2015 by krose

[Glenn9999]

It's been the case for quite some time that the Internet Explorer "cumulative" updates only apply to a certain section of things - this explains multiple "cumulative" updates that are often required for Internet Explorer.  Then they do little "out of band" updates for "severe" security problems.  This is what 3034196 is, which is dependent on 3021952.   Can't blame 'em for being consistent, to be sure, to see the whole required list of IE updates for Win 8.1 x64 (as listed below)

 

I think MS doesn't know what the hell it's doing half most of the time. A cumulative update is just that, it should supercede all previous updates. As it stands now I have five IE11 updates, KB2909210, KB2929437, KB2976627, and now KB3021952 and KB3034196. I add them all to a base image containing only IE11 and it says I still need KB3021952. I updated my laptop by WU and it doesn't need KB3021952 a second time, but it also doesn't install KB3034196. You have to run WU twice to install KB3034196. Some dependency on KB3021952?  Strange things at Redmond to be sure. How about rolling them into one update? Oh there I go making sense.

 

To wit:

2014-08-12          Cumulative Security Update for Internet Explorer 11 for Windows 8.1 for x64-based Systems (KB2976627)Security Bulletin IDs: MS14-051   Listing of File URLs: windows8.1-kb2976627-x64Description: Installing the Microsoft Camera Codec Pack enables the viewing of a variety of device-specific file formats and will allow supported RAW camera files to be viewable in applications in Windows. For a complete listing of supported cameras, see the associated Microsoft Knowledge Base Article for more information. After you install this item, you may have to restart your computer.----------------------------------------------------------------2015-02-05          Security Update for Internet Explorer Flash Player for Windows 8.1 for x64-based Systems (KB3021953)Listing of File URLs: windows8.1-kb3021953-x64Description: A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.----------------------------------------------------------------2015-02-10          Cumulative Security Update for Internet Explorer 11 for Windows 8.1 for x64-based Systems (KB3021952)Security Bulletin IDs: MS15-009   Listing of File URLs: windows8.1-kb3021952-x64windows8.1-kb3023607-x64windows8.1-kb3036197-x64Description: A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.----------------------------------------------------------------2015-02-10          Security Update for Internet Explorer 11 for Windows 8.1 for x64-based Systems (KB3034196)Security Bulletin IDs: MS15-009   Listing of File URLs: windows8.1-kb3034196-x64Description: A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.----------------------------------------------------------------

[bphlpt]

The way I understand it, there is also apparently sometimes a slight difference in the way things are applied through WU vs if you download the updates separately and apply them yourself to either a live or offline source.  ie if you download the updates yourself you have to download KB3021952, KB3023607 and KB3036197 and apply each of them. But if you use WU to apply KB3021952, then it will automatically download and apply all three of them, but only tell you it applied KB3021952. When you "I add them all to a base image containing only IE11 and it says I still need KB3021952.", what it was really complaining about was you were missing KB3023607 and/or KB3036197, but it just called it KB3021952.  You can tell this is true when you compare the size of what it says it is going to download and install as the missing KB3021952.  It's much smaller than the size of KB3021952.  That's also why "I updated my laptop by WU and it doesn't need KB3021952 a second time".

 

Cheers and Regards

[krose]

Thanks gentlemen. I figured it out last night when reading over the KB article again. It was KB3023607 that was missing. Added that to the image and WU is fine now. I don't even use IE, but I'm a bit anal about having it all patched.

[erpdude8]

speaking of KB3023607, that specific patch breaks Cisco AnyConnect VPN Client sofware.

KB3023607 is only offered at WU/MU right now (and not through MS download center) and there's a fix for this "broken" patch mentioned in MS KB article 3023607.

 

Do NOT install the KB3023607 update on machines that have Cisco AnyConnect Secure Mobility Client application installed!

Edited February 17, 2015 by erpdude8