Microsoft on Tuesday released updates to fix 88 security vulnerabilities in its Windows operating systems and related software. The most dangerous of these include four flaws for which there is already exploit code available. There’s also a scary bug affecting all versions of Microsoft Office that can be triggered by a malicious link or attachment. And of course Adobe has its customary monthly security update for Flash Player.
Microsoft says it has so far seen no exploitation against any of the four flaws that were disclosed publicly prior to their patching this week — nor against any of the 88 bugs quashed in this month’s release. All four are privilege escalation flaws: CVE-2019-1064 and CVE-2019-1069 affect Windows 10 and later; CVE-2019-1053 and CVE-2019-0973 both affect all currently supported versions of Windows.
Most of the critical vulnerabilities — those that can be exploited by malware or miscreants to infect systems without any action on the part of the user — are present in Microsoft’s browsers Internet Explorer and Edge.
According to Allan Liska, senior solutions architect at Recorded Future, serious vulnerabilities in this month’s patch batch reside in Microsoft Word (CVE-2019-1034 and CVE-2019-1035).
“This is another memory corruption vulnerability that requires an attacker to send a specially crafted Microsoft Word document for a victim to open, alternatively an attacker could convince a victim to click on a link to a website hosting a malicious Microsoft Word document,” Liska wrote. “This vulnerability affects all versions of Microsoft Word on Windows and Mac as well as Office 365. Given that Microsoft Word Documents are a favorite exploitation tool of cybercriminals, if this vulnerability is reverse engineered it could be widely exploited.”
Microsoft also pushed an update to plug a single critical security hole in Adobe’s Flash Player software, which is waning in use but it still is a target for malware purveyors. Google Chrome auto-updates Flash but also is now making users explicitly enable Flash every time they want to use it. By the summer of 2019 Google will make Chrome users go into their settings to enable it every time they want to run it.
Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are here. Adobe will stop supporting Flash at the end of 2020.
Note that Windows 10 likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, but it is possible. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update. To get there, click the Windows key on your keyboard and type “windows update” into the box that pops up.
Staying up-to-date on Windows patches is good. Updating only after you’ve backed up your important data and files is even better. A good backup means you’re not pulling your hair out if the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches.
As always, if you experience any problems installing any of the patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.
Additional reading:
Will you marry me?
Weird comment!
Umm, ok
All the patches installed on my W10H and W7U machines yesterday, but there was an additional core update (not a malware definitions update) this morning for the W10 machines running v1809 (signed as 2019-02) that took awhile; both digested it okay.
It took me 6 hours to install Windows 10(1903) on a ASUS Republic of Gaming laptop. One black screen of death, one roll back to 1809 and a real nice Blue Screen of Death to complete the whole thing.
Black screen of death is the new blue screen of death?
Everything installed properly on my W10 Pro machine running 1809 yesterday evening, including the 2019-02 update.
It apparently broke custom views in Event Viewer for 1809 and 1903.
Ghacks and BleepingComputer have both reported it.
Since installing when I turn on my computer in the morning it boots with a “You have been logged in with a temporary profile” error. Looks like a fresh install, all docs are gone..etc. When I shut down and reboot it boots correctly.
“Looks like a fresh install, all docs are gone..etc. ”
No, the docs are still there under the old profile. Brows C:\Users as an administrator.
I found a registry fix.
After installing KB4503276 onto Win2012 R2, none of our OSX Macs can connect to the Windows print queues. Most of the Macs are High Sierra. Removing KB4503276 restored print queue access.
Thank you for posting this. It was the only lead I found in troubleshooting the issue. I was getting to that conclusion but your comment saved me a few min if not hours.
Thank you
One of the patches decided to remove my TAP network device so that I couldn’t use my vpn to connect back to the office. Somewhat of a pain to find a solution as just adding one back didn’t work.
I had to find a script to remove all the Windows TAP drivers and then reinstall openvpn in order for it to function again.
Virus e-mail links can never be fixed with patches and updates. Wishful thinking.
Windows attempted an automatic update today which crashed the computer and it will not complete booting up. Just goes into a loop periodically showing the wallpaper but never prompts for the PIN. Rebooting doesn’t help. Now what?
I once had that happen to my grandmother’s computer. The weird thing that worked was to do the update in safe mode.
Every computer is different, but with hers, the sequence was: hold down f12 on reboot, go to the BIOS thing, select “start in safe mode” then let it boot the rest of the way with nothing plugged in. Then do the update. After, reboot normally, then plug in peripherals.
I’m guessing that maybe her printer or mouse or something was interfering with the update. Or one of the background programs, like antivirals. Not sure why.
Ohhh hadn’t seen that one before. Have stopped doing updates 12 months ago as all I get is endless cycles of re-booting that can only be fixed by going into safe mode and roll back to a restore point.
Will try soon as I have some free time….though will so do the usual one at a time.
My computer (2 1/2 yr old Dell) completely crashed and can not reset- going to buy new computer — Mahalo
Can I have the dead one?
The same happened to me. I was installing this update on my Asus, 2-year old computer, and it completely locked up. Computer won’t start up now. You can hear it turn on, but it’s just a black screen. Need to purchase a new computer now. So angry!!!
Just wasted 3 hours doing a Windows Restore on my Dell Windows 7 Pro home sever, thanks to the June update. My issue was quite similar to Christine’s, in that the update hosed the OEM Intel graphics driver somehow.
The system also kept coming to the Windows did not Shut Down properly screen, again and again.
I have not had any issues with prior updates, and have installed no new software. I do use Bitdefender AB software.
I am presently doing a restore back to last week. I hope that fixes it. Christine, you coukd try the same thing.
Some of the windows update has not been update correctly.. Please try and restore the computer to the earlier date. Then download the updates and install it one by one manually.
update done on Dell laptop today and File Explorer will now not work and wallpaper has been removed. Rebooting doesn’t make any difference.
Whats the make of the system and when was the windows installed. Did this happened after windows update?
Why do you keep posting microsoft patch updates?
It’s public knowledge microsoft puts backdoors in there software, really doesn’t matter what “security patches” they release, using microsoft is a huge security threat as it is.
Why don’t you talk about linux??
Bingo !!! You certainly nailed it. Hackers are reading all of this and taking notes and that’s why I entered a fake email.
I am a certified Linux engineer and have been using and implementing it religiously since 97. With that being said, most businesses NEED to run Windows on the desktop. Business Applications are not typically designed for Linux desktops. So, yes, you could create Win VMs and run them within a *nix OS but what does that get you? Nothing but more complex problems and overhead. It’s like when management wants to use a Mac but their underlying infrastructure is pure Windows with Windows only apps. You then need to create a Terminal Services server and create RDCs to a Windows environment just so they can say they use a Mac at work but in reality they are using a Windows session via a Mac.
Thanks Brian, I appreciate your condensed version with your comments regarding Patch Tuesday. The comments section saved our Windows team when the patch was released several months ago that broke SMB! Our teams read Krebs regularly and that was the first place they had noticed the SMB issue so they waited to patch after the fix was pushed out via WSUS.
Exactly!
Microsoft Conspiracy is B.S. they are gathering data but not stealing it. People are openly volunteering it so that’s not on Microsoft, that’s on the people who don’t disable the things in Win10 that they personally don’t want to share.
They could get rid of forcing promotional Windows store apps onto new installs with Microsoft’s ISO’s (on Win10PRO especially) like Candy Crush, Xbox* and home O365 installers. This is why I use Linux now. MY admin (me) will push software onto my PC, not Microsoft.
Linux does something incredible in the form of updates as well. I just installed 11 updates, 8 of which were security updates, while reading this. I hit update, entered by system user credentials, minimized it, and went about my day. The updates installed and closed themselves, and I was never asked to restart and stare at “please wait” screens and lose productive time. This is CRITICAL MICROSOFT!
Microsoft doesn’t build back doors into their products, do you care to share where you are getting your information from?
Laptop updates today on restart black screen only. Cannot get past log in, have had to change pin and password.Nothing will work. Just black screen and cursor. Dead
My father called me yesterday morning to report that his Windows 10 system was telling him that there “no bootable devices found”. Being the computer guy in the family (albeit with a Linux bent, rather than Windows) I went to his place after work and looked at it. He’d already had Windows run checks on the disk/memory/etc. I booted the workstation to a USB Linux image and I was able to mount the disk without problems. I ultimately fixed the problem by going into the BIOS –> Settings –> General –> Boot Sequence and creating a new boot sequence. Being a Linux guy, I didn’t know what I was doing…I just browsed to a likely looking file and tried it. To my surprise and delight, it booted the system, and I was presented with a message from Windows telling me that the update had failed and was being backed-out; Once I saw this, it was pretty clear what had caused the boot failure. The system was ultimately able to boot without any obvious problems, and then I restored the BIOS settings to their original state, and it booted successfully again. My father hasn’t reported any problems with the computer since then. I stopped by his place again tonight and tried to run the Windows Update manually, and it failed. At least this time it didn’t leave the computer unbootable.
After installing win 10 in my Lenovo z570 .it shutdown automatically why?
Call you father iin law, have him run the win 10 program from the command line, called MRT. Either case, it’s one of those hidden programs, that ms has, to annoy people. It looks like a virus checker, and indexer. But updates are usually found after time I run it.
MRT is a Microsoft rootkit search and removal tool normally run by Windows Update.
It does not annoy people who can type MRT in an effort to learn what they don’t know. It is not part of any conspiracy.
It is part of an effort by Microsoft to ramp up security in Windows 10. They have done a great job and deserve credit for it.
The updates ran fine for me as they always do.
Aha!, Yours is one of the lucky few sets that autoruns MRT. As a commoner, having used me for 3.1, and Mint, my sets do not. So on me Tuesday, I turn on my computer, let it run till the activity light goes out, so it will recognize me as wanting to do something, usually about ten minutes, you know, get a cup of coffee, and a snack. Then, check update, nothing new, run MRT, and wait for the finishing close, check update again, and like magic, there is the update. So to delay updates, never run mrt.?
microsoft latest os patches suck. They are doing a horrible job actually.
Update caused other PCs on home network to become invisible/require login credentials… turned out that the “password protected sharing” setting under “all networks” got flipped to true.
Multiple bluescreens on an Acer ASpire F 15, cannot even repair with “sfc /scannow” or restore point as it craps out partway through. This update fried my OS.
Same happened to me. All I see is a black screen. Cannot get to safe mode…nothing. Buying a new computer. Arrrgghhh!
I updated to the new feature update about a week ago no problems, but after this June 2019 Patch Tuesday update Windows 10 will not finish booting up. Its gets to lock screen, I type password, then after about 5 minutes it hangs. I’ve done a recovery to before the update and all is well. I set the updates to not install for I think 35 days. Hoping July Patch Tuesday update will install correctly.
There should be three independent partitions or drives. The first is the operating system. The second is software and device drivers. The third is data. If the operating system is trashed, as happened to me this week by a failed update, the operating system can by replaced without losing software or data.
haven’t we just about had enough?
i switched off updates on m virtual guest Win8 nachine and disabled access to the network
Windows flaws and updates have been the leading cause of failure to boot, and unrecoverable crashes then malware or viruses in my experience, using normal (abnormal, as most don’t?) internet precautions. Like scanning files off the internet with Jotties malware scan (uses a dozen or more virus scanners for files less than 25mb), not clicking on every “free xbox” ad, or on email attachments etc.
Macrium Reflect is a free program that can restore Windows from a bootable recovery DVD the program can make, in only 20 minutes or up to an hour. I get a repeat backups to a normally unplugged USB drive every 2-3 months.
Installed 1903 on my Lenovo just got black screen & continuous circle. Rebooted several times, the same thing. Finally, I had to reset
the laptop and lost all apps. Thanks, Microsoft
After installing this update, none of the macs on my network can connect to our windows file share.
Hi Dan,
In the same boat here – tried everything I can find and now none of the macs on our network can connect to our windows file share. Has anyone found a solution? My coworkers are getting frustrated!
This sounded vaguely familiar. I wonder if it is related. I’ve got no idea if this works or not.
https://superuser.com/questions/1394317/after-installing-kb4480970-i-cannot-access-shared-folders-or-printers
I came across that too, but I’m running Windows 10 so not sure it would apply…
Thanks for the link – I did come across that one in my research, but the patch only applies to Windows 7 from what I can tell.
Ok, well good luck.
Same boat here. smb broken, thank you Microsoft.
Received the sextortion email last evening. Seems to be going around. Anything one can do to prevent these from even getting through, outside of the sneaker-net moving to the Junk Folder route? Beware — these people live!
dcarter@napier.bayford.co.nz
Hello!
I am a hacker who has access to your operating system.
I also have full access to your account.
I’ve been watching you for a few months now.
The fact is that you were infected with malware through an adult site that you visited.
If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.
I also have access to all your contacts and all your correspondence.
Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.
I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks.
I can also post access to all your e-mail correspondence and messengers that you use.
If you want to prevent this,
transfer the amount of $500 to my bitcoin address (if you do not know how to do this, write to Google: “Buy Bitcoin”).
My bitcoin address (BTC Wallet) is: 3DJDLZvRtkmHi7tkejzMhA4J522Fe6aRSC
After receiving the payment, I will delete the video and you will never hear me again.
I give you 50 hours (more than 2 days) to pay.
I have a notice reading this letter, and the timer will work when you see this letter.
Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address.
I do not make any mistakes.
If I find that you have shared this message with someone else, the video will be immediately distributed.
Best regards!
It sort of surprises me that Flash, even though it’s not being further developed, continues to encounter exploitable holes in their code. One would have thought the time would come when no more could be discovered. It seems to have bugs in more places than I’d expect it to have places. Perhaps Dr. Krebs could explain some day why the end never comes for the need to patch.
Windows 10 did a bios flash on my ASUS Vivo on June 14, 2019 Now all I get is a black screen. What can I do?
My ASUS Vivo had a bios update from Windows on June 14, 2019 and now it just gives me a black screen. Help
You’ll likely need to have Acer perform some major maintenance requiring you to ship or take it to an authorized repair service, as a farkled BIOS update generally bricks the system. Sorry.
My Windows Surface Book 2 completely crashed after update. I took the computer to Microsoft, but they told me it could be anything. I know my laptop was in perfect condition before the update and the guarantee expired in may, just a month ago.
My Lenovo Miix 700 also is a mess after the update. Only runs for 5ish minutes every 5 restarts or so. Not pleased. Can’t even roll back the update it seems.
Isn’t it time Bill Gates took control of Microsoft again, fired the completely incompetent staff, came up with a complete new system that works and that would be distributed to every user free of charge?
Why hasn’t Microsoft been sued for breach of contract?
They glibly tell you that you have only purchased a license to use the product. But to me that implies the product does not infringe on my time with crashes and all the other things people put up with.
A class action suing their pants off is what is really required