Patching in Review – Week 35 of 2019

As we approach Labor Day weekend, vendors have been busy releasing numerous updates, with Google Chrome getting a final security release for the month.

This week Microsoft finally removed the WSUS hold for KB4512506/KB4512486. In review, the highest-profile bug from August’s Patch Tuesday originated from the SHA-2 migration for Windows 7 and Server 2008 R2 and its compatibility with Symantec Endpoint Protection. The issue stemmed from a fear that the software may not correctly identify system files being patched and might leave the machine in an incomplete state, which could affect stability. Woody on Windows via ComputerWorld wrote an article detailing the aftermath with a great point: “The block is gone, but questions remain. Nothing has changed, so why was it blocked in the first place?”

Security Releases

Google Chrome released version 76.0.3809.132 with a total of three security fixes reported by the vendor and a single CVE. Although CVE-2019-5869 was classified as a “High” severity, CIS released an advisory recommending expedited remediation. The vulnerability covers a scenario where an attacker could execute arbitrary code though a maliciously crafted website to perform numerous functions in the context of the user rights.

Third-Party Updates

Outside of the critical release above, this week has not been boring with considerable non-security releases for the week. It’s worth remembering that these updates may contain undisclosed security remediations as well as helpful stability fixes.