October 2009 Security Database Updates are Available

  • Article

The October 2009 Security Updates  are now available on the ECE for Windows® Embedded Standard 2009 and/or Microsoft® Windows® XP Embedded with Service Pack 2, Feature Pack 2007, Update Rollup 1.0 and Service Pack 3.

The security updates can be applied to the component database.This download is a cumulative update which incorporates all updates from prior months. Therefore you do not need to download and install previous monthly updates from ECE.

The October Security updates include:

  • 970653 August 2009 cumulative time zone update for Microsoft Windows operating systems
  • 971961 Vulnerability in JScript Scripting Engine Could Allow Remote Code Execution
  • 958869 Vulnerabilities in GDI+ Could Allow Remote Code Execution.
  • 969059 Vulnerability in Indexing Service Could Allow Remote Code Execution
  • 971486 Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
  • 973525 Cumulative Security Update of ActiveX Kill Bits
  • 974112 Vulnerability in Windows Media Player Could Allow Remote Code Execution
  • 974455 Cumulative Security Update for Internet Explorer
  • 974571 Vulnerabilities in Windows CryptoAPI Could Allow Spoofing
  • 975254 Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution
  • 975467 Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service
  • 956844 Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution
  • 973812 Vulnerabilities in Windows Media Format Could Allow Remote Code Execution.
  • 975682 Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution.
  • 896358 A vulnerability in HTML Help could allow remote code execution

Additional Details:

In Odd numbered months, the Security Supplement Update CD contains the Security DQI updates for just that current month, and cumulative Component Database updates in the \Windows folder for each supported Embedded version (SP2, Feature Pack 2007 or Update Rollup 1.0) through the previous even numbered month. In Even numbered months, the Security Supplement Update CD contains the Security DQI updates for just that current month, and the cumulative Component Database updates for each supported Embedded version, which are updated to include the previous odd numbered month, and the current even numbered month updates.

If you are servicing your existing development environment:

On the Embedded Security Supplement Update CD in the \Windows folder, there is a Component Database Update available for each supported Embedded product version (SP2, FP2007, UPR1). If you install the Component Database update applicable to the product version you are using, your database will be current with security updates up to and including the most current even month’s security updates.

If you are servicing deployed images:

Assuming you had the cumulative Component Database updates applied to your development environment  on your image creation date, you need only deliver the DQI updates for each month following your release date and have them applied directly to the image ­or you can update your development environment as described above, and deliver a new image for re-deployment. There may be other methods you employ for servicing your images, these are the two most basic approaches you can take with the updates we provide.

If you are a new developer installing XP Embedded for the first time:

Install XP Embedded up to the product version you wish to use (SP2, Feature Pack 2007 or Update Rollup 1.0). Then install the cumulative Database Component updates provided for that version from the latest Security Supplement Update CD to bring your database up to date with all security updates up to the most recent even numbered month.

Miscellaneous Optional updates:

You will also see other updates available on the ECE which are Optional Updates. These may or may not be applicable to your image and you can review the release notes for applicability to determine if you wish to implement them. These may be provided in DQI format, Component Database update format, or both.

Note:

The Security Supplement Updates were called just Supplement Updates through October 2007, when the name changed to Security Supplement Updates.

If you have questions on accessing the ECE, please email MS Mobile & Embedded Communications Feedback & Support, ECE@microsoft.com.

Thanks,

- Lynda

Technorati Tags: XPe,Standard 2009