Hi all,

A few important announcements:

• There will be no optional updates for Version 1909 and older for a while.
• Although Version 2004 is likely to show up to everyone later, 60-day countdown for Version 1909 cumulative update announcements will start today. The last regular cumulative update notice for 1909 will be sent on July 14, 2020.
• For now a separate email will be sent regarding Version 2004 prerelease cumulative updates. Once May 2020 Update (build 19041) shows up for everyone, cumulative updates for both 1909 and 2004 will be bundled into a single post.

May 2020 cumulative update for Version 1909 (KB4556799/build 18363.836) is now available:

https://support.microsoft.com/en-us/help/4556799/windows-10-update-kb4556799

Changelog:

• Updates to improve security when using Internet Explorer and Microsoft Edge.

• Updates to improve security when using input devices such as a mouse, keyboard, or stylus.

• Updates for verifying usernames and passwords.

• Updates to improve security when using Microsoft Xbox.

• Updates to improve security when Windows performs basic operations.

• Updates for storing and managing files.

• Updates to improve security when using Microsoft Office products.

Details:

• Updates the 2020 start date for daylight saving time (DST) in the Kingdom of Morocco.

• Security updates to Internet Explorer, the Microsoft Scripting Engine, Windows App Platform and Frameworks, Microsoft Graphics Component, Windows Input and Composition, Windows Media, Windows Shell, Microsoft Xbox, Microsoft Edge, Windows Fundamentals, Windows Cryptography, Windows Authentication, Windows Kernel, Windows Linux, Windows Update Stack, Windows Network Security and Containers, Windows Active Directory, Windows Storage and Filesystems, and the Microsoft JET Database Engine. 

Thanks.

Cheers,

Joseph

Hi,

Special follow-up: it turns out this update closes a local security loophole that has been in existence for quarter of a century:

https://www.zdnet.com/article/printdemon-vulnerability-impacts-all-windows-versions/?ftag=COS-05-10aaa0g&taid=5ebc74e9974886000166e987&utm_campaign=trueAnthem%3A+Trending+Content&utm_medium=trueAnthem&utm_source=twitter

The PrintDemon vulnerability (CVE 2020-1048), otherwise known as Print Spooler Local Privilege Escalation (LPE) can best be described as fooling Windows to “print” to a protected file. According to the original source cited by ZDNet and other outlets, this is caused by how Print Spooler service works and how printers are actually seen by Windows. The good news is that a fix for it is included in build 18363.836, and unless you click an attachment or run a program that are designed to exploit it somehow, you are safe.

Cheers,

Joseph