MS14-021, KB2964358, KB2964444, oh my!

[Guest langware]

I am running Windows 7 pro 64-bit. I have IE10 installed and Windows Update set to "check for updates".

 

 

MS14-021 was just announced. Under the "known issues" section, that announcement says this:

 

• 2964444 Description of the security update for Internet Explorer for systems that do not have security update 2929437 installed: May 1, 2014
  
• 2964358 Description of the security update for Internet Explorer for systems that have security update 2929437 installed: May 1, 2014
  Known issues in security update 2964358:
  
  • Internet Explorer will crash if you try to install security update 2964358 on a Windows 7-based system that does not already have security update 2929437 installed. To avoid this issue, take either of the following actions:
    
    • Install security update 2929437, and then install security update 2964358.
      
    • Install security update 2964444 instead of security update 2964358. Security update 2964444 is intended for systems that do not have security update 2929437 installed.
      

     

   

 

I looked in my Windows Update queue and 2964358 is listed. But according to MS14-021, update 2964358 requires 2929437. However, according to the description of 2929437, it is "a cumulative update for Internet Explorer 11". A search of my installed updates shows that KB2929437 has not been installed on my computer (which is expected since 2929437 is an update for IE11 and I have IE10).

 

 

So, it would seem that I should just install KB2964444.

 

 

Some questions:

 

1. Is there a bug in Windows Update (or in the way KB2964358 was built/targeted) which resulted in KB2964358 being placed into my Windows Update queue when it is clear that KB2964358 requires KB2929437 which is an update for IE11 (which is not installed on my computer).
   
2. Instead of KB2964358 being placed into my queue, why wasn't KB2964444 placed into my queue by Windows Update?
   
3. What would happen if I had not read the fine print and blindly installed KB2964358 (without having KB2929437). The description of MS14-021 says that in this case "Internet Explorer will crash". That's bad enough. How would one recover? Any other bad behaviors besides IE crashing?
   
4. If Windows Update is not smart enough to avoid placing KB2964358 into my queue (because I do not have KB2929437 and do not have IE11), then shouldn't the installation process for KB2964358 be smart enough to detect the presence/absence of KB2929437 and warn the user (and not complete the installation) if KB2929437 is not present on the user's computer?
   
5. Will Microsoft fix the Windows Update "targeting" problem for KB2964358 such that it will not be offered/installed if the user does not have IE11 (and thus does not have KB2929437), and offer/install KB2964444?
   

 

Continue reading...