HOTFIXES: Win2000 SP4, WinXP SP2, WinXP SP3 and Win2003 SP2

[the_guy]

I'm really busy, I'm going away this weekend, so this will have to wait until next weekend (along with the new ones released next Tuesday).

the_guy

[Nilfred]

Quote me, then copy & paste the quoted text:

UPDATE LOG

April 3, 2007

Added KB925902 for Win2k SP4

Added KB925902 and KB935448 for WinXP SP2

Removed KB896424 and KB912919 for Win2k SP4

Removed KB896424, KB912919 and KB928843 for WinXP SP2

MS WINDOWS XP PRO SP2 - (66)

KB925902 -> Vulnerabilities in GDI Could Allow Remote Code Execution

Download -> 1.7 MB (April 3, 2007)

Switches: KB925902.exe /q /n /z

KB935448 -> The Realtek HD Audio Control Panel may not start, and you receive an error message when you start the computer: "Illegal System DLL Relocation"

Download -> 703 KB (April 3, 2007)

Switches: KB935448.exe /q /n /z

MS WINDOWS 2000 PRO SP4 - (55)

KB925902 -> Vulnerabilities in GDI Could Allow Remote Code Execution

Download -> 1.5 MB (April 3, 2007)

Switches: KB925902.exe /passive /norestart /quiet

Edited April 6, 2007 by Nilfred

[ponghy]

- Please delete this post, duplicated -

Edited April 5, 2007 by ponghy

[ponghy]

Add to the Nilfred's list hotfix KB935448, that fixes the issues of KB925902 (Realtek HD Control Panel problems).

In addition, KB928843 is no longer necessary, because this hotfix has been superceeded by KB935448.

Note: Files contained in KB935448 and KB928843 are the same in version and size (HHCTRL.OCX), so be careful, the newer version is in KB935448, and these files are binary different. Microsoft should mark with a different version the new file, but they didn't.

Regards.

[Nilfred]

Roger that.

Also note that KB925902 requires 2 (two) reboots for dissapearing from the list of updates, and the error appears on first reboot, not the second. So maybe KB935448 isn't really required.

[ponghy]

Nilfred: KB935448 is required for those users using the Realtek HD drivers. If this patch is not applied, these users will receive severe errors (generated by KB925902) when starting up the system. Therefore, it's better to use KB935448 than KB928843 (at least ONE is required to patch the ActiveX vulnerability), since both patches fix the same vulnerability, but the former has no address conflicts and the latter it has. Also, it has been reported that KB935448 fixes other issues introduced by KB925902, not only the Realtek HD problem.

Edited April 7, 2007 by ponghy

[oao]

Hi,

I've compared this list of hotfixes for Win2K Pro SP4 with that provided for HFSLIP at http://users.telenet.be/tc76/winup/_win2k.html and the latter has the following which this list does not. Any ideas why?

* Microsoft Data Access Components (MDAC) 2.8 SP1

* KB887606 FIX: The Microsoft XML Parser (MSXML) uses cached credentials incorrectly

* KB927978 MS06-071: Security update for Microsoft XML Core Services 4.0

* Microsoft Core XML Services (MSXML) 6.0 Service Pack 1

* Roots certificate update

* KB908506 Update for Windows 2000

* KB926121 Security Update for Windows 2000

* KB926247 MS06-074: Vulnerability in Simple Network Management Protocol (SNMP) could allow remote code execution

* KB909520 Microsoft Base Smart Card Cryptographic Service Provider Package: x86

* KB917275 Microsoft Windows Rights Management Services Client with Service Pack 2 - x86

* WindowsUpdateAgent20-x86.exe

Also, neither the HFSLIP list nor this one have the following:

* KB896422 Security Update for Windows 2000

* KB828026 Critical Update for Windows Media Player (All Versions) for Windows 2000, Windows XP, and Windows Server 2003

* KB870669 Microsoft Data Access Components - Disable ADODB.Stream object from Internet Explorer

* KB885492 Security Update for Windows Media Player 9 Series

* KB904368 Update for Windows 2000

* KB903235 Security Update for JView Profiler

* KB911565 Security Update for Windows Media Player 9

* KB912812 Cumulative Update for Internet Explorer 6 SP1

* KB891122 Update for DRM-enabled Media Players

* KB911564 Security Update for Windows Media Player Plug-in

Windows Update insists to apply the first two, 896422 and 828026, even after they are removed.

Pls advise.

Thanks.

FP

Edited April 8, 2007 by oao

[Nilfred]

WTF? Nobody else notice the new updates? Deja vu?

930178 Vulnerabilities in CSRSS Could Allow Remote Code Execution (930178)

931261 Vulnerability in Universal Plug and Play Could Allow Remote Code Execution (931261)

931784 Vulnerability in Windows Kernel Could Allow Elevation of Privilege (931784)

Also replace KB929338

932168 Vulnerability in Microsoft Agent Could Allow Remote Code Execution (932168)

Edited April 12, 2007 by Nilfred

[Colt45]

has anyone compiled a list of updates post SP2 without IE7, and only WMP10 installed?

[the_guy]

The list has been updated. I've also made a decision to include Windows Server 2003 SP2 updates. It will make it easier for any 2003 users out there to keep an updated CD.

Comments anyone?

the_guy

[Pis19]

The list has been updated. I've also made a decision to include Windows Server 2003 SP2 updates. It will make it easier for any 2003 users out there to keep an updated CD.

Comments anyone?

the_guy

In my opinion, KB935448 is a Windows update and not an hotfix, so it shouldn't be included in the hotfix list. Then, what hotfix has replaced KB928843?

Thanks!

[DStealth]

how do you miss this one?

New WGA released Feb. 28, 2007

***UPDATE***

KB905474 -> Windows Genuine Advantage Notifications application

Download -> 1.3 MB (Version 1.7.0018.1)

Switches: KB905474.exe /q:a /r:n - sorry, had this wrong before, my mistake

Edited April 16, 2007 by DStealth

[the_guy]

how do you miss this one?

New WGA released Feb. 28, 2007

***UPDATE***

KB905474 -› Windows Genuine Advantage Notifications application

Download -› 1.3 MB (Version 1.7.0018.1)

Switches: KB905474.exe /q /n /z

Missed it somehow. Added!

@Pis19: KB935448 replaces KB928843. I feel it's important because it's a High Priority update.

Any comments about adding 2003 updates?

the_guy

[TheCrowX]

@ the_guy Thanx for your great work and for the contributors

[RyanVM]

In my opinion, KB935448 is a Windows update and not an hotfix