June 2013 Internet Explorer Updates


Microsoft Security Bulletin MS13-047 – Critical

This security update resolves nineteen privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10 on Windows servers. For more information, see the full bulletin.

Recommendation. Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

Microsoft Security Advisory (2755801)

Today, we also announced the availability of an update for Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8 and Windows Server 2012. The details of the vulnerabilities are documented in Adobe security bulletin APSB13-16   

The update addresses vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10.  For more information, see the advisory.

Most customers have automatic updating enabled and will not need to take any action because this update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

— Ceri Gallacher, Program Manager, Internet Explorer

Comments (27)

  1. Yannick says:

    Nice to see all the bugfixes. However, I hope the next blogpost is about Internet Explorer 11! :D

  2. florin says:

    hello,

    these usability bugs were closed with no repro but they are real and can easily be fixed if you haven't already done that:

    connect.microsoft.com/…/SearchResults.aspx

  3. @florin says:

    If you file a bug you should enter more info so people can reproduce it.

    For instance you filed a bug about a personalized TPL causing problems on a site.

    You should at least have included info on which things you block with that TPL that leads to this behaviour. Also al relevant settings you personalized and also use of things like anti malware programs or firewalls which could also influence this kind of behaviour.

  4. pmbAustin says:

    So, the issues I have with IE9/IE10 aren't "memory leaks" per se… what seems to be happening is that pages are "crashing" silently and reloading. But when they reload, they reload into an existing iexplore.exe process, growing it.  Over time, all the open tabs seems to consolidate into mostly one process, making it HUGE.  When it gets over about 700MB in size, things stop rendering correctly.  For example, the top blue bar on the Facebook home page (with notifications and navigation) just disappears.  It's still there, and if you know where to hover and click, you can access the functionality, but it doesn't render.  If you keep on going, more things fail to render… embedded YouTube videos, for example.  If you continue, eventually things in the OS won't render… common dialog boxes open to your pictures library won't render thumbnails, for example.

    You either have to completely exit out of the browser (let all processes die), or use Task Manager to kill the bloated process.  When this happens, many new iexplorer.exe processes are spawned and the pages reload, and all is back to working order.

  5. EricLaw says:

    @pmbAustin: When this happens, use Process Explorer to take a look at the "giant" process. What are the handle counts?

  6. @pmbAustin says:

    Like EricLaw said, please get the handle counts from Process Explorer and post it here. You can download it from System Internals website technet.microsoft.com/…/bb896653.aspx

  7. @pmbaustin says:

    If pages are crashing can you identify which particular pages are crashing?

    Are you using addons like Flash or Ghostery? Have you tried uninstalling them and then reinstalling them?

    Do you block tracking trough tpl's and, if so, are you using a personalized tracking protection list.  

  8. pmbAustin says:

    I'm using stock, out of the box IE10 on Windows 8 Professional on a laptop.  The only settings I really modify is setting the MRU Tab order for tab switching/cycling.  

    I've viewed handle counts in Task Manager, and they're around 5,000ish generally, sometimes more, sometimes less, but never near 10,000 that I've seen yet.  It's almost always associated with a process size of 700MB or larger.

    As for why the pages crash, and which pages crash… I have very little idea.  There's no logging, no pop ups.  It's mostly what I've deduced is happening (over time, the number of processes shrinks even though the number of tabs has remained constant) and I've OCCASIONALLY caught it in the act with a page that has no business reloading (it doesn't have an auto-refresh/reload cycle on the page) reloading.  It's a wide variety of pages, not just one or "one type" of page/site.  Nothing has jumped out at me to correlate a cause here yet.  The pages are generally javascript-heavy and show ads, but that describes most pages these days.

  9. Thomas says:

    thank you

  10. steve says:

    Does this include a fix for the textarea bug that has plagued IE10 on (Windows 8/ Windows 7) since launch?

    It seems like this kind of usability regression bug should be fixed within weeks of a release for a truly agile modern developer.  However seeing that it has been almost 9 months (NINE MONTHS!!!!) how can we have ANY credibility in Microsoft?

    Seriously – when the !@#$% is this going to get fixed its incredibly frustrating!

  11. ie8tabloss says:

    Please change tabs back to defaulting to user specified default web page.  You have rendered tabs too annoying to be useful with your suggestion boxes.  

  12. Microsawft says:

    The next IE 11 will have an anti lag feature.

  13. Haroon butt says:

    @pmbAustin

    Please run the diagnostics utility for IE (Start  > type "iediag" without quotes and hit enter)

    More on blogs.msdn.com/…/ie-diagnostics.aspx

    Then upload your readings to SkyDrive or some place publicly accessible. I highly recommend you to compile the whole case and post it here, IE's technet social forums (social.technet.microsoft.com/…/home) and Microsoft Connect (http://connect.microsoft.com/) and then you may stand a little chance to get their attention!

    I have heard that they are overhauling the tab management  in IE11. Wait till next week. Build 2013 is on next week and they would provide first public preview for Windows Blue and then you can also verify if the bloating issues are resolved in v11. Next week would be exiting though! :)

  14. Jackson toh says:

    Good to use

  15. Xero says:

    @Haroon butt, I am also waiting for Build conference. I am planning to install Windows blue (8.1) in Hyper-V as soon as will arrive. My experience with Hyper-V is that the guest OS works like host one! It is greatly optimized in Windows 2012 and Windows 8 when it comes to speed and handful of features. I wish if IE team borrow some great techy minds from Windows, Hyper-V, Visual Studio, Expression Studio and Visual C teams for only ONE month.. IE would be one of the greatest, performant, state-of-the-art, visually next-generation looking and the most optimized browser known to the man kind!  

    If people in Microsoft really start collaborating, like WebMatrix team with the team responsible for IE's F12 developer tools, they can provide them mobile testing tools for iOS, Android and Symbian devices (which WebMatrix provide with a mere extension!)… But apparently collaboration is the concept only exercised by SharePoint team at Microsoft and "being performant" is attribute of Visual C team … Unite them to get wonderful future!

  16. Webm says:

    Can anybody tell me If IE11 will support WebM or not?

  17. Arieta says:

    @Webm: IE has been supporting WebM since IE9, as an optional codec.

    @steve: What textarea bug? The only bug I know, which also plagues all other input elements, is the one where the onchange event fires if there is a placeholder and you click in the input field (which can cause infinite loops).

    I think it was onchange, it's been a while since I checked.

  18. IE User says:

    When closing the IE 10 browser windows doesn't always notice that I have closed the browser and doesn't clear cookies or anything from the browser.

  19. Real McCoy says:

    @Arieta, textarea bugS not a bug. Lets start with a simple textarea like the one in this comments section.

    Typing Basics:

    Type "this is some text" and press Ctrl+Z. The type "this is", press backspace twice, the type "is some text" and press Ctrl+Z twice and then Ctrl+Y to redo. Try it on Firefox, Chrome and Safari or any text editor (except ofcourse notepad!!!).

    Fore more wonders, try out http://www.cdolivet.com/…/exemple_full.html in several browsers (and please don't blame the developer for this macabre disaster).

    Last year I covered more purview here: connect.microsoft.com/…/problems-with-popups-iframe-based-rich-text-editors

    I don't understand how folks at Microsoft work on IE when they are supposed to deal with textarea and long inputs? I guess the standard way is to first type everything in Word, and then paste in IE. An input field with multiple lines of text with undo, redo, copy, paste, text selection features… sounds like an assignment of one of those basic programing course they teach in Computer Science college!!

    IE is the MOST notorious team in the entire Microsoft, the largest software company on the planet. They are doing everything to embarrass the consumers Shame on the person who wrote this crappy logic behind textarea in first place. Shame on the person who approved it. Here we are in 2013, discussing bugs in textarea field. How many times and in how many Microsoft's products, this thing is implemented.  How about re-usability of some text editor code from products like Visual Studio, Word, WordPad SharePoint. Seriously, shame on you guys!

  20. maris says:

    gribu skatītie vido

  21. @maris says:

    Welcome to the planet Earth.

    jūs varat skatīties video pie http://youtube.com tik daudz, cik jums patīk!

  22. Yannick says:

    Well, only 2 days until Internet Explorer 11 (and Winodws 8.1). :)

  23. ANNETTE LAMERE says:

    NONE

  24. Carmen sepulveda says:

    I hate this bullshit

    you make everything so dam hard just get to the point why can you make this easy

  25. @Carmen says:

    "Install the update, it's better"

    Is that to the point enough?