IE 9.0.9 Available via Windows Update


The August 2012 Cumulative Security Update for Internet Explorer is now available via Windows Update. This security update resolves four privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows servers For more information, see the full bulletin.

Most customers have enabled automatic updating and do not need to take any action. We recommend that customers, who have not enabled automatic updating, enable it (Start Menu, type “Windows Update”). We recommend that administrators, enterprise installations, and end users who want to install this security update manually, apply the update immediately using update management software or by checking for updates using the Microsoft Update service.

—Tyson Storey, Program Manager, Internet Explorer

Comments (40)

  1. too late says:

    Well I guess yet another IE development cycle is over.  IE10/Windows 8 is going RTM tomorrow to ship to customers Oct 26th and MSDN subscribers can grab the final version tomorrow.

    Truly a sad day when Microsoft ships a 1/2 finished browser and the Metro disaster due to the Windows team having to hit an unrealistic RTM date so they can attempt to ship tablets before Christmas.

    Good news IE developers!  Google, Apple, RIM, & Opera, & Mozilla are all hiring!  This means you can safely jump to a real development team that is committed to shipping quality software vs. waterfall software by timelines.

    Just ask Chris Wilson how much better things have been for him since leaving the Internet Explorer Team!

    Pete LePage escaped too and many others.

    Say it loud, say it proud… time to abandon ship!

  2. @too late says:

    Windows 8 RTM-ed on Aug 1, FYI. Ignorant troll is ignorant.

    And how specifically is IE10 a half-finished browser?

    You mean Google's and Mozilla's timelines are better, with their fast release cycles?

    Please, don't be so hypocritical next time, or keep things to yourself.

    This is an IE9-and-Windows-Update-related post, by the way – but obviously you can't read.

  3. @Victor says:

    Replies never get lost in these blogs. Microsoft staff reads them and replies only to those who are worthy questions and aren't so aggressive.

  4. @Victor says:

    Shouldn't have developed your line of business app using Flash/Flex then. It was a bad decision then and is a bad decision now.

  5. Dave says:

    For everyone getting their MSDN copy of Windows 8 today please test Metro IE 10 and confirm which sites that use flash still work for you and post the sites names back here in the IE Blog.

    This is no longer just an issue about censorship it is now a full blown business conspiracy!  Since none of these site owners have had production windows 8 devices to test on they could not have met the qualification requirements to apply to be on the censorship list.  

    Therefore if they are on the list it is because Microsoft added them to the list on their behalf!

    Looks like we'd better keep the DOJ (Department Of Justice) on speed dial – Microsoft is playing dirty again!

  6. Marcus says:

    ie9 is slow on my windows7 pc, i want to know when ie10 will be released for my windows7 pc, and i hope it's much lighter then ie9.

  7. pmbAustin says:

    I sure hope IE10-Win7 makes its debut sometime soon.

    I sure hope IE10 in general gets updated far more frequently than every 3 years.   Or even every year.

  8. @Dave says:

    Preview devices have been widely available. Today, the RTM version of Windows 8 is available on MSDN and TechNet. If you are a developer, you can use it for testing. Actually, quite a few sites are already on the CV list because they passed testing. YouTube is the most distinguished one. Neither Microsoft nor Adobe is playing dirty. Their policies have been public for a long time now.

  9. George says:

    Apparently, the DOM problem has been fixed (it wasn't a critical issue anyway). nontroppo.org/…/Hixie_DOM.html gives these results on my Laptop:

    Total elapsed time: 391ms

    Breakdown (fraction shows time relative to append time):

     Append:  1.00; 88ms

     Prepend: 0.98; 86ms

     Index:   0.16; 14ms

     Insert:  0.94; 83ms

     Remove:  1.36; 120ms

    IE10 is light and fast, but I think it will be faster on Windows 8 because of the improvements done under-the-hood.

  10. Prior Semblance says:

    @Marcus

    If IE9 is too slow for you then you have some serious computer problems or too many crappy add-ons.

  11. Yannick says:

    Nice, already updated. But when we can start using Internet Explorer 10 on Windows 7 and Windows Server 2008 R2? On the dev center, there's a page that says it's comming soon. But when is soon?

  12. computer love says:

    i love microsolt…..while iconic IE browsers recently have been not the trend setter

  13. CoyCoy says:

    @George, the issue is indeed resolved! I just installed RTM and checked it. Thanks for the heads up man  🙂

    I have been following IE team for this issue for couple of months (connect.microsoft.com/…/ie-performance-dom-manipulation-tests). Except Try/Catch brute force stress test #3 (which is not a real world scenario btw; throwing 4000 consecutive exceptions that is..), the DOM processing is extremely fast and some major improvements have been made.

    Thank you IE team for these improvements and hard work!

  14. Rhyck says:

    Is there any direct download link for IE9

  15. Martijn says:

    I love how Microsoft fixes their security issues, but never any normal bugs.

    IE9 contains lots of bugs (especially rendering bugs). Fix them! Come on!

  16. Edward says:

    Can we as users send in requests for sites to be included on the censorship list?

    I would like all the sites I view that show funny videos to work in my default browser without kicking me out to the desktop. (#Usability #Fail)

    Let's start with:

    YouTube

    Break

    College humor

    Zero punctuation

    Funny or die

    Homestar runner

    The website is down

    Any of the "best flash games" sites

    Stumble upon

    Plus any site that lets me edit photos

    Or any site that lets me create vector drawings or flowcharts

    Or any site that uses interactive flash

    Or any site that might use flash

    Wait just make flash work everywhere like it does now that would be much better.

    Wait whose dumb idea was it to block sites by default anyway!?

    Oh yeah it was Microsoft – thanks for ruining the Web – Again!

  17. Yannick says:

    @ It wasn't Microsoft idea, it was Apples.

  18. @Edward says:

    YouTube is fully working on Immersive IE10. Both Flash mode and HTML5 mode. Break is working too. Also, you're not tweeting, stop using hash tags.

  19. Marcus says:

    @@Edward hash tags were around for ages before twitter came along.

    As for the flash disaster in IE10 it would be food to know exactly who at Microsoft signed off on this (air quote)feature(/air quote).

    I'd like to see whomever is responsible for this highly controversial whitelist and attempt to defend **ANY** aspect of it with the developer community and users alike.

    Based on all that I've heard, seen, and read there is absolutely no on that's thinks this is a good idea and this includes 3 developers on the IE team itself!

    The concept is backwards – it should be a user defined BLACKLIST if included at all

    The list application process is beyond acceptable for any dev shop to complete and adhere to

    Forcing developers to buy hardware to re-test something that has worked in production for years is outrageous!

    Having to wait 2 months for approval is unacceptable in a real-time world

    Having to wait an additional month to get pushed to users (presuming they accept the patch) is beyond atrocious!

    Ruining the users desktop metro experience because windows tablets have poor battery life is not acceptable!

    Being 100% silent on the issue when developers and users have pointed out nothing but flaw after flaw with this whole plan is shameful – I will never parter with Microsoft based on the behavior I've seen from Microsoft on this blog.

    Forcing developers to expose private website/web app content for Microsoft to inspect is NOT OK and we will not betray our customers security!

    No one from Microsoft has discussed yet how often the whitelist URLs are re-checked and what the process is if we no longer meet the whitelist requirements! Is there a grace period? Do we get a warning? How often does Microsoft recheck?

    Will Microsoft post an FAQ on their site indicating that it is their Big Brother rules that are disabling website functionality and not the site developers that are at fault?! And will a link to this appear on all sites in metro when flash does not work so that users can understand what is going on?

    The wise move if you ask me would be to write a post on the IE blog stating:

    "hey we'd like to appologies for our over zealous attempt to control flash use on the web and we are hereby pleased to announce that we've decided to scale back our flash compatibility whitelist completely.  In windows 8 service pack 1 due out October 27th"

    In the mean time as long as there is silence from Microsoft I am going to actively advice all of my clients to upgrade to Chrome or Firefox – they shouldn't have to suffer because Microsoft has project management issues with PMs sitting in Ivory Towers.

  20. @Marcus says:

    Windows 8 hasn't hit GA yet.

    Keep your "knowledge", "self-confidence" and especially your ***FUD*** to yourself.

    If you're unhappy with IE or Windows, there are other choices.

  21. pj says:

    when IE10 for windows 7 going to be released?? windows 8 is already RTMed now.

  22. Adam says:

    @@Marcus – care to explain which part of @Marcus's post was FUD?! I've read all the conditions to apply for the whitelist and they match what he posted – in fact he missed a few points too.

    If you can point is to the single microsoft page where a developer can enter their URL and click submit to be added please do so!

    I'm DISGUSTED! With Microsoft and their shinanigans on filtering Adobe Flash.

  23. ReimondX says:

    Make Internet Explorer 10 available for Windows 7 for users who want it. We the users shouldn't have to upgrade to Windows 8 to use Internet Explorer 10!

  24. Jack says:

    @ReimondX – we don't need to update to windows8.

    just use the fastest browse with windows7, like: google-chrome, or firefox, or opera, or other webbrowswe.

  25. Diamond River says:

    or we can always use Xbuntu or Mac or another OS then windows8

  26. @Adam says:

    "Forcing developers to buy hardware to re-test something that has worked in production for years is outrageous!" o.O in a parallel universe, maybe?

    "Ruining the users desktop metro experience because windows tablets have poor battery life is not acceptable!" o.O ruining?! how so? if you don't like windows 8, don't use it.

    "Forcing developers to expose private website/web app content for Microsoft to inspect is NOT OK and we will not betray our customers security!" :O now that is pure speculation!

    msdn.microsoft.com/…/jj193557(v=vs.85).aspx READ IT!!! There is an entire section on how to submit your website for testing! Let me cite it for you, since it is SOOOOO difficult to read…

    ————————

    Submitting your site for consideration

    Developers can submit their sites that they want to be included on the CV list to Microsoft via email.

    To submit your site for consideration to the CV list, email iepo@microsoft.com and include the following details:

    1.Your name, company, title, and contact information

    2.The domain you want considered (http://contoso.com/) and the specific pages containing Flash content ( http://contoso.com/video, http://contoso.com/media)

    3.The approximate unique users per month that visit the domain

    4.The capabilities your Flash content requires. For more info see Guidelines for Flash Content in Internet Explorer 10 in this topic.

    5.The name and version of the SWF your site is using, including version number for third party .SWF files if appropriate (for example, videoplayer.swf v1.2 from Contoso)

    6.A list of any other plugs-ins (not Flash) your domain depends on and the specific pages containing those controls. Be aware that if your site depends on other plug-ins, users will be directed to open your site in Internet Explorer 10 for the desktop.

    7.The results of your testing of the pages listed in step two (2) of these steps. For more info see Test Guidance and Test Cases in this topic.

    ————————

    I'm sorry I've been harsh sometimes, but comments like that are SOOOO annoying!

  27. Alex DiNozzo says:

    Windows 8 will be a failure, this whole new Microsoft UI experience is a crap idea and a crap program, I look at the facebook stock failure and I see that being Windows 8 you cannot expect desktop users to want to use a tablets UI so I am not pretending to accept Windows 8 and certainly will not buy it even if that means I use Windows 7 when it hits the EOL

  28. Daniel says:

    @"@Adam" you've attempted to show that Microsoft is not playing silly games and you've failed really hard.

    All the points you published are EXACTLY THE ITEMS THAT WE TAKE MAJOR ISSUES WITH!

    #2) the domain and every single URL that you wasn't flash to work on! Are you nuts?! I have upload controls on 1/2 of my editable forms, all on pages that could be anywhere in my app(s)! Even loaded on the fly with AJAX!  We want to submit http://www.example.[com|ca|org|net]/* I'm not going on a wild goose chase to find every last possible URL – no fother mucking way!

    #3) my sites uniques? I don't recall that EVER being Microsofts business (and completely irrelevant to getting on the list)

    #5) Excuse me?! The name and version of every flash control I use? Does this include the "pages" that are generated from my help file building tool with the hashed file names?! Why does Microsoft need to know which ole upload tool I use?, or which flash chart tool?, or which video wrapper?, or which audio wrapper?, or which font substitution tool?

    #7) the results of the extensive testing (according to the test case plan) on touchscreen PCs (which I don't have and have no intention to buy (now or ever)) as well as a tablet (yeah one of those things you cant buy yet) with hardware accelleration on and off landscape and portrait, snapped big and small, pinched and unpinched, panned, zoomed etc for every flash control on every website property we run on an Operating system that only went to MSDN last week (and no I don't have an account) approximately 20 hours per site on hardware we don't own, can't buy, and don't even want!

    Which part of this absolutely, completely utterly retarded process seems logical to you?  How does any of this help the john smith that works in your typical office environment on his laptop PC that is docked to his workstation, plugged into the wall?! When the week before he upgraded to windows 8 due to a global IT initiative everything worked just fine in his default web browser!!!

    Does he get a message from Microsoft saying:

    "we've improved your web browsing experience by removing the ability for you to run the Adobe Flash based content you ran last week!, now when you upload you must load 1 file at a time… Some fonts will look like crud, none of your charts will display, your real-time dashboard you paid extra for won't work and all your audio and video links won't work either!  – welcome to Metro!

    What really pi$$3s us off the most is not only was there no need for a whitelist to begin with, not only should it be a blacklist defined by the user if they are so concerned but you went to the trouble of re-writing the flash plugin with Adobe to ensure it would be lightweight and then turned around and smacked developers with a wet fish telling us that we have to be elite to get on the list to even let the content load!

    I have no idea why Microsoft is sitting so silently on this when EVERYONE (except some of the MS ganboys) have very clearly and very openly told you this is the worst software design decision you have made in IE/Windows 8!!!

    How much louder do we have to yell it??! Do we have to pass around a petition and get 50,000 signatures before you listen?!?!

    The kicker is that you haven't even come on the IE Blog to confront the criticism, attempt to backup any of the thought process behind this EPIC FAIL or even explain why you are ignoring all the totally legitimate pitfalls to this plan that are pointed out daily on this blog!

    Take some responsibility for your position in the community and post a status update!

    Has anyone been fired over this yet?

    Who signed off on this before shipping RTM?!

    Who do we directly email to express our disgust with the stance that Microsoft is taking?

    If we sign up for the Azure developer days are you going to accept vocal protest?!

    Where is Dean in all this! Has he not been told by enterprise developers that we are not happy about this in the slightest?!

    Someone please see if MSFT can offer an olive branch to Chris Wilson to get him to talk some sense into the IE Team.

    –so utterly frustrated by Microsoft's wall of silence!

  29. PhistucK says:

    @@Adam (meaning, the one who replied, not the original) –

    The first point… well, not necessarily new hardware, but a new (in development) operating system (if you hardware can keep up with it) is still a major annoyance.

    Also, what was your point when you quoted the instructions?

    The instructions you stated seem to require websites to be popular or at least public. If the Flash content is password protected, or private, or the whole website is internal or simply private, these instructions seems to say, "screw you".

  30. @Daniel, @PhistucK says:

    Touch hardware can be even a "Windows 7 capacitive touch monitor that has a minimum of two touch points and a minimum resolution of 1366×768".

    Immersive IE is targeted at Touch devices, that's why touch is so important.

    Number of unique visitors is needed:

    1) to put you on the queue before any less-visited sites

    2) to compile Microsoft's services demographic studies

    Also, you can achieve password protection even without Flash, then proceed to loading Flash content.

    Let me cite once more from the mentioned document:

    ————————–

    Summary

    In summary, developers control how their sites work in Windows 8 with Internet Explorer 10 in the Metro style UI. For websites with Flash content, the site owner has the following options:

    •Detect that the request is coming from Internet Explorer 10 and serve a plug-in free version of your site.

    •Use the registry key described previously along with available documentation to make your Flash content compatible with Internet Explorer 10. After your Flash content is compatible with Internet Explorer 10, submit the site to Microsoft for evaluation and addition to the CV List for Flash.

    •Add META-tag/header in HTML to prompt the user to switch to Internet Explorer for the desktop to view your site with plug-ins enabled.

    •Do nothing – your site will display in Internet Explorer 10 without Flash.

    ————————–

    This situation is specific only to Windows 8 RT devices, which must be treated like mobile devices. Devices using other editions of Windows 8, can fully load Flash content in the Desktop browser.

  31. Liam says:

    Hold on! This Adobe Flash list requirements are getting waaay out of control!!!

    Touch hardware can be Windows 7 (that's great, but still no one has bought any of this crap because Microsoft hasn't made an OS that uses it yet! (except for Windows 8 that isn't officially shipping until October) (Its a classic Cart before the Horse Fail))

    Unique visitor count? So bigger sites get on the list first? I thought Microsoft insisted this wasn't a censorship list?

    We are fed up with the SILENCE MICROSOFT! Give us some answers please!

    I don't want to have to jump through endless hoops just to get my flash content (that changes weekly) across dozens of sites to work in the default IE10 / Windows 8 browser!  I don't think that this should be such an epic battle.  Just make it work and give up this stupid list that no one (ESPECIALLY THE ACTUAL END USERS THAT ARE PAYING FOR THIS OPERATING SYSTEM!!!!) actually want.

    No one wants this list – just get rid of it!

    No one wants this list – just get rid of it!

    No one wants this list – just get rid of it!

    No one wants this list – just get rid of it!

    No one wants this list – just get rid of it!

    Seriously how many thousand times do we need to tell you that you messed up?  The writing is all over the wall… all over the Internet… Developers everywhere are laughing at Microsoft for even thinking that there was a remote chance that any of this was at all sensible!

    The Flash censorship list is 100% complete waste of time for Microsoft, Developers, Customers, IT Administrators & End Users.

    Which part of this does Microsoft not get?

    Its UnF______Believable that Microsoft has not given us a status update on the death of this plan.

  32. IE10 is worse than IE9.

    1) "Hung tabs" and crashes are much more often ("Hung tabs" are tabs whose header had turned blank; you cannot switch to them)

    2) Middle click often does nothing. The link turns purple, but no new tab is opened.

    3) IE10 often starts to use CPU in kernel mode bringing my 6-core 16Gb RAM system to a crawl. Even mouse pointer lags.

    IE engine can be good, but IE browser is more crappy that ever.

  33. @Fduch says:

    I've been using IE10 in Windows 8 DP, CP, RP and now in Windows 8 RTM. I haven't experienced ANY of those three issues on either of my laptops:

    – Dell Inspiron, 3GB RAM, Pentium Processor, Intel HD 3000 graphics

    – Gateway NV, 4GB RAM, Intel Core i5 processor, ATI Mobility Radeon HD 5650 graphics.

    Maybe you should install drivers for your devices. If that doesn't help, try doing a fresh install.

  34. ^^^

    You just use only a few tabs and don't reopen your sessions. I use many tabs and do "reopen last session" after starting my PC.

    Randomly not working middle-button drives me mad. I go to google and "middle-click" 6 pages. Then I see that only 2 opened. Madness.

    BTW, you try reproducing another long-standing bug that I hate.

    Step 1) Open a page where you can save/download .zip (or any non-image file). Save it to some non-default location (for example, folder "test" on Desktop). Open another page where you can download non-image file. Try to save the file. Notice that IE remembered the previous folder for this file type (like all good Windows programs do).

    Step 2) Now try to do the same with image files. IE always shows you Library/Pictures as the save location when you try to save image from a new tab, forgetting the last save location.

  35. Gordon says:

    @Fduch – agreed a very annoying bug!

    I will NEVER, EVER, EVER want to save ANY PICTURE to the Library/{ANY} folder!  This drives me bonkers in Windows applications!… save the last directory I used… and use it always.

  36. Gordon and Fduch,

    I think you'll find the experience a lot more pleasant if you use the Libraries feature in Windows 7+ as it is intended — as a collation of your own folders.

    If you have an alternate folder you want to save pictures to by default,

    1) Right-click on the Pictures library in Windows Explorer, then click "Include a folder" and select that folder….. OR, find the folder in Windows Explorer and use the "Include in library" button on the toolbar.

    2) Choose that folder from the library locations list and click "Set save location".

    In the future, IE will use that directory by default, as well any application that correctly uses the Windows 7+ Libraries feature.

  37. Daniel says:

    Where is the promised version of IE10 for Windows 7 now 4 months overdue since win8 went to RTM!

    Glad to see you waited for our feedback to ensure that bugs got found and fixed.

    What a disaster Microsoft – are you ever going to listen to the developer community again or was IE9 the last chance for that and the boat has sailed?

    RIP Microsoft transparency and open communication.

  38. @Fduch, @Gordon says:

    I actually work with 15+ tabs most of the time. I used to use "Reopen last session" but then I switched to "Start with tabs from the last session" (purely a matter of preference).

    I use subsequent middle-clicking a lot when I'm searching (I use Bing, but I don't think it's related) and haven't found a problem yet with that. Maybe it's the mouse drivers? Try separating middle-clicks by 0.5s, to solve this issue.

    As for the second one, it's more of an annoyance than a bug. My parents (non-tech-savvy) like it.

    Personally, I have been using what warrens described since I got Windows 7. Easy enough.

  39. sam says:

    File dialogs should always default back to the last opened location for that file type.

    IE10's default is wrong. Period.

  40. yuhong2 says:

    BTW, this update for IE9 on Win7 seems to have no symbols on MS symbol servers:

    SYMSRV:  msdl.microsoft.com/…/BB42B9EA10CC4AA5B

    411984C5525EED52/mshtml.pdb not found