October 10, 2017 - KB4041678 (Security-only update) Windows 7

October 10, 2017 -KB4041678 (Security-only update)


Improvements and fixes

This security update includes quality improvements. No new operating system features are being introduced in this update. Key changes include:

• Security updates to Microsoft Windows Search Component, Windows kernel-mode drivers, Microsoft Graphics Component, Internet Explorer, Windows kernel, Windows Wireless Networking, Microsoft JET Database Engine, and the Windows SMB Server.

For more information about the resolved security vulnerabilities, please refer to the Security Update Guide.

Known issues in this update

Microsoft is not currently aware of any issues with this update.

How to get this update

To get the standalone package for this update, go to the Microsoft Update Catalog website.

File information

For a list of the files that are provided in this update, download the file information for update 4041678.

Click to expand...

Source: https://support.microsoft.com/en-us/help/4041678


Direct download links for KB4041678 MSU file from Microsoft Update Catalog:

:ar: Download KB4041678 MSU for Windows 7 32-bit (x86) - 19.1 MB

:ar: Download KB4041678 MSU for Windows 7 64-bit (x64) - 31.5 MB

Article states: "This update will be downloaded and installed automatically from Windows Update. To get the standalone package for this update, go to the Microsoft Update Catalog website."

Has Microsoft changed how it's delivering the Security-only updates? Or are they just not checking the info in their own articles?
Haven't seen any Security-only update appear in Windows update, even after hiding the Rollup?

I believe it's just a mistake made by Microsoft in the article.

Thanks Shawn. Yeah, I was scratching my head a little when I read that.

I just checked the previous months Security-only article and seems they all say that - never noticed before.

Reported it to MS. They really should change that, as it could get confusing for some users who opt out of the rollups.

Thanks Brink.

I think they just "forgot" to mention that it is surrounded by the monthly roll-up.
Art

Brds7t7 said:

Reported it to MS. They really should change that, as it could get confusing for some users who opt out of the rollups.

Click to expand...

MS doesn't want people to use the Security Only updates.

They want to sneak garbage features like W10 Telemetry, GWX, auto-mandatory updates, etc. into your PC.

Just imagine, if everyone could have easily bypassed the GWX, almost no one would have installed W10.

Does anyone know if this update includes the patch for the Krack WPA-2 vulnerability? I tried reading the mumbo jumbo from MS on this update but only got a headache.

Lady Fitzgerald said:

Does anyone know if this update includes the patch for the Krack WPA-2 vulnerability? I tried reading the mumbo jumbo from MS on this update but only got a headache.

Click to expand...

From what I've read, the Krack vulnerability was patched in the October 10th Security updates.

Apparently, MS knew about the vulnerability before it became big news.

Brds7t7 said:

From what I've read, the Krack vulnerability was patched in the October 10th Security updates.

Apparently, MS knew about the vulnerability before it became big news.

Click to expand...

Someone on another forum (Shh! Don't tell anyone.) pointed me to verification that the Krack patch was included in the latest Security only updates.

All the router manufacturers and OS developers were notified about Krack 90 days before it was made public to give them time to patch it. It's both curious, and commendable, that MS made patches that covered everything of theirs that is still current, unlike anyone else (last I heard, Apple was going to but hadn't yet at the time).

I'm becoming somewhat disenchanted with Netgear since it appears they can't be bothered to patch my router against krack, despite recently issuing an unrelated patch.

Yes, kudos to MS for fixing it quickly. All of my Windows devices are up to date. I've just updated my Android phone last month after having the same one for 3 years (I'm not one of these users that feels the need to upgrade to the latest and greatest ASAP), so my new device will be covered when Google issues a patch. I don't have WiFi turned on when I'm out and about anyway, and never use any kind of public WiFi.

However, I do still use a Nexus 7 from 2013 and I doubt that's ever going to get an update now. It's usually kept at home so probably not too much of an issue as I'll never use it out and about. Unless somebody is scanning for networks right outside my house, I'm pretty sure it'll be safe, until I decide to upgrade it. Not even sure I'll bother with a tablet again anyway. I'll probably just get another laptop to replace it.