Security Advisory 2755801 Revised to Address Adobe Flash Player Issues

Today we released an update that addresses vulnerabilities in Adobe Flash Player in Internet Explorer 10 on Windows 8. The majority of customers have automatic updates enabled and will not need to take any action because the update will be downloaded and installed automatically. For those manually updating, we encourage you to apply this update as quickly as possible.

This update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash binaries contained within Internet Explorer 10. For more information, see the advisory.

— Vishwac Sena Kannan, Program Manager, Internet Explorer

Comments (40)

  1. acidcode says:

    Glad that I'm not even able to use it…

  2. Sam says:

    If flash would run properly in metro IE 10 then this would be an issue. However since Microsoft added the flash censorship list we can't even submit our content for approval yet.  Even more annoying Microsoft has refused to answer any of our questions on it or respond to the issues we've raised!

  3. Aaron says:

    @Sam lucky for us when Windows 8 goes Live to the public on Oct 26th this month we will actually be able to go and buy hardware that can run windows 8 with all the multi-touch stuff.  Therefore we only need to spend $1400 on a brand new PC and then we can test our flash content on all the properties we own/manage… Then after a week of testing we can gather up all the results file it along with all the private info about our sites with login access to our private applications so they can test our URLs (read: never in a million years would this pass government or HIPAA security!) and submit it to Microsoft!

    Then up to 2 months later they will get back to us to let us know if we are accepted (likely not because we won't abandon our users security) and then we have only another month to get that whitelist pushed to users (and hope like heck that accept it!

    So by some time in February our users might be able to use content in IE10 that they've already been using for the past 6-8 years without issue or intervention.

    To call this whole mess a gloriously epic fail on Microsofts part would be a massive understatement.  Microsoft had the chance to do the right thing and provide proper flash support in Metro IE but instead decided that somehow this chaos they've created would somehow be better.

    I still can't believe Microsoft has had the gall to sit here silently and completely ignore the users, developers, and testers that have pointed out all the problems with this plan.  Just admit you screwed up and pushed a concept to the production line without thinking the whole thing through!  You're only human, it happens to all of us! But to sit there without saying a word is down right arrogant and something developers and users can't stand.

    You've done more bad For your Public Relations in the past few months with this flash list than Apple with their stupid maps… At least Apple admitted they screwed up!

  4. Mike Dimmick says:

    Sam, Aaron: Flash still works fully on the desktop. From the 'Metro' appbar, click the spanner icon then pick 'View on the desktop' from the popup menu. You can direct IE to produce a popup indicating that the control is required by adding the HTTP header or meta tag documented at…/web-sites-and-a-plug-in-free-web.aspx .

  5. David says:

    @Aaron, because they didn't screwed up anything, so they don't have to admit it. I admit that they have done a wonderful job when iOS and Android have dropped the complete flash support, WinRT is only disallowing the flash movies that can impact the battery life on low energy devices. If you using Win8, you have a desktop browser. You can set it as default and it doesn't censor flash.

    I am using Windows 8 RTM on Pentium 4 1.2GHz and 1GB DDR2 RAM. The system takes 25-30 seconds to boot and shows the Start Screen. Its extremely fast and performant. There are tons of improvements over Win7 in the desktop environment. The drivers support is even more tangible than 7. Visualization software are deeply integrated. Process management, disk management and file management are also improved.

    You don't "have to" use touch screen. If anyone saying this is totally misleading. You click on icon to launch a program in desktop and you click on tile to launch app on Start screen. Windows 8 supports all kinds of input devices such as; keyboard, mouse, pen, marker, stylus, all kinds of touchscreens (resistive, capacitative etc.) and soon-to-come Kinect support!

    Now, after 26th Oct, if I spend $80 ($39.99 x 2) to upgrade Vista on laptop and XP on desktop it won't be too much.

  6. steve says:

    @Mike Dimmick – yeah we all know how screwed up it is.

    1.) Open Metro IE on your **DESKTOP** computer because it is now the DEFAULT BROWSER!

    2.) Navigate to Web App of choice

    3.) Login ********

    4.) Navigate in Web App to that important thing you need (dashboard charts, file upload, copy/paste/clipboard utility, video or audio container)

    5.) Oopsie! "you can't do that in Metro IE"[TM] you need to use desktop IE!

    6.) Leave your Metro IE browser (still logged in, with session wide open), switch visual contexts, now on the desktop as IE10 Desktop version launches and takes you to your page

    7.) Uh oh you're not logged in/session expired! – you are redirected to the login page

    8.) Login (Again!) ********

    9.) If you're lucky, you'll get redirected back to the page, but in most scenarios you are now staring at the welcome page

    10.) Navigate in Web App to that important thing you need (Again!)

    11.) Use your app as needed because now you have the fully capable browser!

    12.) Logout of your app in Desktop IE.

    13.) Forget that you were also logged in on the Metro version of IE and that you've left your session wide open for anyone with access to your PC to access your private data

    Now @Mike Dimmick do you see any flaws in this? yeah I sure do… why wasn't my session carried over?… why did IE not share my session and cache? what is that black window back in Metro IE, why didn't Microsoft tell me that I was going to be leaving a session wide open?

    As it has been discussed on this Blog over and over… this plan is horribly flawed.  If Microsoft would actually join the conversation then we could work on resolving all of these issues but when they completely ignore us its no wonder that we get ticked off and angry.

    Hostile developer communities are not what Microsoft needs right now.

  7. Larry says:

    We're still waiting for Microsoft to step forward and start addressing (or at least discussing) the usability and security issues we've presented to Microsoft over the past 3 months in regards to the disastrous double browser issues in Windows 8 and of course the spectacular fail known by developers worldwide now as "The Flash Censorship List"!

    The silence is not helping your case Microsoft and in fact it is doing a whirlwind of bad PR for Windows 8 right now causing many IT admins to delay deploying Windows 8 for at least a year until this mess is all sorted out.

    All the big enterprise web app/saas offerings have already declared that they won't be supporting Metro IE over the security concerns with abandoned sessions and terrible usability.

    It's a walking train wreck right now and the gossip alone is killing the product before it even launches!

  8. Prior Semblance says:

    In a year, flash content will be even more dead then it is now.

  9. @steve says:

    so your situation *may* occur the first time a user visits that site…next time they'll just use desktop ie….

    wow – what an issue!

  10. Michael Smith says:

    @steve, I know even after reading this comment you will come on MSDN blog again, and post the same crap again and again, until the day you won't show up. If there is NEVER a good news for you on MSDN blogs (as it is evident from you zillions of negative comments in previous blogs), why do you bother to come here?

    You can change default browser to desktop IE after the install right away. If you are in Europe, the default browser selection dialogs appear as you first log into your system.

    Google, Apple and Adobe itself are pushing industry to HTML5 standards. Singling out Microsoft sounds more like a personal grudges against software giant (out of hatred, because your girlfriend uses Android or some other sociopath reason) is something nobody can help you with. May be a shrink? Or maybe it can get better over the time in this very lifetime — no guarantees though. If you hate MSFT, you can always switch to another operating system, use non-msft products and stop coming to MSDN blogs after eating lots of food to take a dump.

  11. Floyd says:

    @Michael Smith your comments tone and language is insulting and totally in called for!

    If you have issues with what this "Steve" user had to say that's fine provide a retort or links and facts as arguments against his opinion but don't assume that this Steve is the same as every other (I'm pretty sure that Steve is a very common name I know several personally)

    As for the issue being discussed in all the posts right now (the flash list) readers will likely continue to posts questions and voice complaints until Microsoft provides some information and answers.

    I'm no genius but I can tell you from my own experiences that it is definitely not user-centric nor user-friendly and contrary to mentions above you can *not* set desktop IE as the default browser.

    In fact until you install adobe reader you are even forced from desktop IE back into metro if you try and open a PDF!

    Usability is the number one concern in software right now and Windows 8 is in for a rough ride in user acceptance with such dramatic change for very little if any improvement.

    I will give Microsoft credit that metro will likely work very well for tablets but using the interface on a desktop is cumbersome and confusing and deprives users of a lot if control and keyboard shortcuts they've mastered over the last 2 decades.

    So Michael please clean up your act and Microsoft please start responding to the concerns of your readers… We've seen dozens of valid questions, usability issues and security concerns raised but not a single response – please keep us in the loop instead of in the dark.



  12. Floyd says:

    I meant uncalled for… When mentioning Michaels comments.

  13. KARINA says:


  14. @Floyd says:

    How to make IE desktop in Windows 8:

    Open Internet Explorer options>Programs>Under Opening Internet Explorer “choose Always in Internet Explorer on the desktop” and click ok to save the changes.

    Now stop bitching please.

  15. @Floyd says:

    Floyd said:   you can *not* set desktop IE as the default browser.


    because, you CAN set IE desktop as the default browser in Windows 8:

    Open Internet Explorer options>Programs>Under Opening Internet Explorer “choose Always in Internet Explorer on the desktop” and click ok to save the changes.

  16. @Floyd says:…/choose-how-you-open-links.png

    Now please clean up your mess, pack your *** and get going..

  17. George says:

    People, if you're SO b*tthurt by IE, don't bother coming here and annoying us with your sh*tty comments.


    On topic: I know that certain updates require a restart, but why do IE Flash updates require restarts?

  18. Terry says:

    @Floyd, I am using Windows 8 RP and I can open PDF in Adobe PDF. I have IE desktop as a default browser and if I open the PDF in browser, it opens in IE desktop not the Metro. Your comments are full of hatered and misleading people. Have you actually used Windows 8?

  19. shankarkumar says:

    year 2012

  20. Kyle says:

    So @Floyd wasn't aware that you can set Desktop IE as your default browser so you want to throw him under a bus?!

    All the MSFT trolls can moan all you want about minor mistakes in our comments but lets be serious and get down to facts.

    There are serious concerns about usability.

    There are unresolved issues with submitting to the flash list

    There are countless arguments as to why the flash list is a bad idea and the wrong implementation

    There are major concerns about the security holes created with double contexts and this double sessions

    There has been no response from Microsoft on any of the issued raised

    The promised windows 7 version of IE10 is nowhere in sight and thus many developers have not tested any content in IE10 yet

    As soon as Microsoft wakes up and starts responding to our concerns, complaints, and bug reports then there will be less ranting on the IE blog.  However if all the ms fanboy trolls can do is fine one minor error in our comments and try to tear us a new one over it all they end up doing is making Microsoft (as well as the ms trolls) look bad and incapable of working towards a better product!

  21. @Kyle says:

    Kiss the *ss of Apple if you don't like MS.

    Have a nice day.

  22. Malchore says:

    @Kyle, there is a difference between troll and a fanboy. They are opposite. You being troll, and I am trying to understand why should I become one like yourself? Exactly which features am I missing in IE10 that should be a big enough deal to start trolling against this ~18 years product and the entire company? You said "There are serious concerns about usability." Give us some examples please.

    If the while listing of flash would really be a "major" issue, Adobe would be the first people who had raised this issue through their press. But no, they supported Microsoft in making a localized/native and embedded version of flash plugin in Windows 8. Because Adobe is making a paradigm shift towards HTML5 and they are almost there!

    Also, Microsoft is not the only company limiting the flash support. iOS-since-beginning and Android-since-jellybean has COMPLETELY discontinued flash support. Have you EVER wrote a comment on their websites? I don't think so. They don't even have blogs where you can post anonymously. Your rage exclusively against Microsoft is how we know who your employer is!

  23. Darren says:

    Ah lovely an MS troll war!

    This isn't about people that work at Apple, Google, Mozilla or anywhere else.

    There have been several well documented issues on this blog posted in the last 3 months once the betas were released.

    I'm not going to re-hash them here now they've been mentioned dozens of times already.

    The big point that should be taken from all of this as that Microsoft is sitting silent rather than responding to the problems raised.

    It's truly embarrassing Microsoft – a response is the absolute minimum that Microsoft could do and you've failed miserably at living up to your side of the bargain.


  24. Edward says:

    Just sat my 10yr old son down to try out windows 8 on a laptop.

    I decided not to help him at all, no hints, nothing.

    Here's the list of things that caused him to stumble (and I expect all users to stumble on)

    1.) scrolling the metro tiles on a non-tablet is not intuitive at all

    2.) once a game was launched in metro it wasn't obvious at all how to exit, escape key doesn't work and there is no mouse action to exit

    3.) once on the real desktop, the lack of start button took 15 minutes to find (extremely unintuitive)

    4.) can't find the control panel to adjust sound an connect to wireless network

    5.) back in metro, launched IE went to a kids site, no flash support but there was an install link

    6.) install basically took him to desktop mode (install failed) and he re-navigated to the website in desktop ie

    7.) he wanted the original window so he had to go back to metro (10min)

    8.) tried website again didn't work because flash won't install in metro

    9.) clicked another link in metro IE to see if it would work.. Opened a new tab he wanted to go back but couldn't and he couldn't access the tabs

    10.) went back to the desktop and stated "why did they add all those squares? That part of windows doesn't work, can we get rid of it?"

    Long story short – there are major usability issues caused by trying to add the tablet UI to the desktop. Lets be honest and call a spade a spade… The metro UI experience on the desktop is a catastrophic failure. I seriously hope there will be an option to turn it off… Otherwise I'm sticking with windows 7 until a real OS upgrade comes out.  I don't want to be a Vista beta tester again.

  25. @Edward says:

    " I seriously hope there will be an option to turn it off… "

    Really? Everybody knows there is no such option, and there will never be one.

    " Otherwise I'm sticking with windows 7 until a real OS upgrade comes out. "

    Why not stay with Windows 95 after all?

  26. Martin says:

    I have some code that will disable Metro completely and allow booting directly into Windows desktop in windows 8.

    I'm just waiting until the first (likely zero day) patch is out for windows 8 then I will be releasing it publicly. Based on Microsofts previous actions blocking the loopholes I don't want them trying to block this utility in the initial patch.

    Better yet we'd all appreciate it if Microsoft did not block any of these utilities especially when there is such high demand for them on an OS that hasn't even released yet!

    I must confess with Metro gone in Windows 8 the performance is great and all the navigation headaches of metro/desktop are gone! And the OS feels really slick!

  27. harry man says:

    Release IE10 for Win 7!!

  28. Xbox says:

    Will you write an article about bringing IE to Xbox? That would be interesting to read.

  29. Craig says:

    Write an article about bringing IE to Xbox?! What?! How about no articles about anything until there is a version of IE10 for Windows 7!!!! And some flippin' answers to our questions about flash, usability, security holes, etc. on Windows 8/Metro IE?!?!?!

    We're tired of waiting… For Pete's sake give us something to let us know that Microsoft hasn't completely bailed on developers!

    This is the first time in history we've had to tell our clients before a major IE release that we will not be supporting it.  Before it even ships no less!

    Soooooooo frustrating!!!!!!!! Get your act together Microsoft!

  30. Steve C says:

    Can we get the name and email address of whomever is responsible at Microsoft for this "Flash Whitelist"?!

    As an enterprise Web Application developer I have some serious complaints and issues to raise about this an Microsoft's silence in the matter is absolutely infuriating!

    I want to write/talk to whomever is directly in charge of this – this nonsense has gone way to far and we see no hope in heck of a fix/redaction of this before the October 26th launch!

    Seriously Microsoft you need to be accountable to (or at least contactable) developers.

  31. @Steve C says:

    I really hope you've been working on expanding beyond flash development.  Even without IE10, flash is dying.  When you work in technology you don't get to keep doing the same stuff for your entire life.

  32. Barry says:

    @"@Steve C" I think if Metro IE was 100% Flash support… or 100% Non-Flash support there wouldn't be any issues.  The problem is there is 100% Flash support only if Microsoft approves your content.  The further problem is that the turnaround time for this approval is up to 3 months…  then there is no information about approval renewals or new content approvals or revocations… then there's the privacy issues with the information required to submit for the list in the first place… which would be a problem if you could apply!  however since applying requires full testing on compatible multi-touch hardware that isn't commercially available yet… we're stuck in a horrible Catch 22 situation.

    We have 10 days until IE10 on Windows 8 goes live – yet we can run the tests yet… so that we can send the results in… so that we can apply for addition to the whitelist… so that within 3 months we can run in the default Windows 8 browser.

    To say that this whole thing is a "Cluster Flup" would be a huge understatement.

    Add to this that Microsoft won't even talk about any of the issues (not a single one!) is a very major concern!  I do not want to develop for a platform where the platform vendor won't answer any questions or even clarify their design decisions.

    As the Queen would say: "We are not amused!"

  33. @Barry says:

    Well, please tell us which platform vendor answers all of your questions, your Majesty.

  34. Travis says:

    Back when Microsoft had Chris Wilson and Eric Lawrence leading the IE development they helped the IE team care about developers.

    Now that it is just the "marketing guy" running the show e.g. Dean M. They couldn't give a toss about developers and it shows… Badly!

    As for all the issues with IE10 and Windows 8 there's obviously a lot of problems but for me the biggest is that the tablet/desktop user experience is actually not consistent at all which is strange as it was the only goal of forcing the tablet UI on desktop users!

    E.g switching tabs or exposing the address bar in Metro IE is like pulling teeth on the desktop yet easy as pie on the tablet.

    So what's the story? Is there no one left on the IE team that cares about developers? I guess there's no point in going to MIX next year… Especially after the disappointment of this years event!

  35. lets change our name says:

    same tripe by the same trolls using different names and the exact same writing style

  36. hahah says:

    You've been told how flash will work in IE10.  They have already given their reasons whether you like them or not.  IE10 is already RTM.  It's done.  People are already installing it.   It's not going to change no matter how much you whine.  Get over it.

  37. Jerome says:

    Just over a week before launch of Windows 8 and IE10 and still not a word from Microsoft about the complaints from readers on this blog.

    Quality commitment Microsoft!

    Microsoft IE Team – Ivory Tower[TM] development at its finest!

  38. Harry Richter says:

    Here is something for the alternative Browser fans:

    Quote from Tom's Hardware:…/robohornet-web-browser-performance,3303-3.html

    "Internet Explorer 10 smashes the competition, performing 37% better than even the latest version of Google's Chrome and earning the only score in this test to double the baseline. Still no slouch, Chrome 21 is far ahead of third-place finisher Opera 12, at 71% and 33% above baseline (respectively). Firefox 15 again places last."

    It is nice to see IE10 so far ahead of the competition.


  39. Dave says:

    @Harry Richter – it's easy to score well against other browsers when:

    1.) you built the new OS and you're the only one who knows how it works

    2.) when you don't fully expose the low level performance tweaks you are using

    3.) when your browser doesn't need to support older windows versions or other Operating Systems

    4.) when you don't come even close to supporting half of the HTML5 content that other browsers do

    But yeah… If you want the crappy user experience that IE provides it will render really fast.  However since most of us care about the user experience we'd rather surf in Chrome or Firefox a few ms slower than suffer in IE.

    But hey, thanks for trying to divert the conversation away from Microsofts lack of communication! It worked for like at least 30 seconds.

    Now where is that Windows 7 version?!

    Now when are we going to talk about Win8 RT/slate compatibility failures?!

    Now when are we going to talk about usability and this rediculoius flash whitelist?!