Microsoft Windows Security Updates July 2018 release overview

Jul 10, 2018

Updated • Jul 13, 2018

It is July 10, 2018 today and that means it is time for our monthly Microsoft Patch Day overview. Microsoft releases security updates for company products on the second Tuesday of each month.

Our coverage includes all important information about today's releases. It begins with an executive summary that lists the most important information right away. We look at the operating system distribution of patches for all supported client and server versions of Windows, and list all released updates afterward.

Links are provided to Microsoft Support pages to look up additional information and to download the updates.

Our overview includes security advisories and known issues, direct downloads of security patches, and links to resources.

Check out last month's overview here.

Microsoft Windows Security Updates July 2018

The following Excel spreadsheet contains all security updates that Microsoft released today for all of its products. Click on the following link to download it:Â Â July 2018 Windows Security Updates

Executive Summary

Microsoft released security updates for all client and server versions of Windows.
No critical vulnerabilities for all client and server versions of Windows.
Critical vulnerabilities in Edge and Internet Explorer.
Other Microsoft products with security updates are: Microsoft Office, .NET Framework, ASP.NET, Visual Studio, Skype for Business and Microsoft Lync, and Internet Explorer / Microsoft Edge

Operating System Distribution

Windows 7: 7 vulnerabilities of which 7 are important.
Windows 8.1: 9 vulnerabilities of which 9 are important.
Windows 10 version 1607: 8 vulnerabilities of which 8 are important.
Windows 10 version 1703: 8 vulnerabilities of which 8 are important.
Windows 10 version 1709: 8 vulnerabilities of which 8 are important.
Windows 10 version 1803: 7 vulnerabilities of which 7 are important.

Windows Server products

Windows Server 2008 R2: 8 vulnerabilities of which 8 are important.
Windows Server 2012 and 2012 R2: 9 vulnerabilities of which 9 are important.
Windows Server 2016: 8 vulnerabilities of which 8 are important.

Other Microsoft Products

Internet Explorer 11: 6 vulnerabilities, 4 critical, 2 important
Microsoft Edge: 19 vulnerabilities, 12 critical, 7 important

Windows Security Updates

KB4338823 -- Windows 7 SP1 Security-only update

Protection againstÂ Lazy Floating Point (FP) State Restore (CVE-2018-3665) for 64-Bit (x64) versions of Windows.
Security updates to Internet Explorer, Windows apps, Windows graphics, Windows Shell, Windows datacenter networking, Windows wireless networking, and Windows virtualization.

KB4338818 --Â Windows 7 SP1 Monthly rollup

Same asÂ KB4338823.
Internet Explorer update to conform to the policy that disabled the launch of Developer Tools.
Fixed DNS requests disregarding proxy configurations in IE and Edge (copy and paste gone wrong, Edge not available for Windows 7).

KB4338824 -- Windows 8.1 Security-only update

Protection againstÂ Lazy Floating Point (FP) State Restore (CVE-2018-3665) for 64-Bit (x64) versions of Windows.
Provides protections from an additional subclass of speculative execution side-channel vulnerability known as Speculative Store Bypass (CVE-2018-3639). (see here (client) and here (server)
Provides support to control usage of Indirect Branch Prediction Barrier (IBPB) on some AMD processors (CPUs) for mitigating CVE-2017-5715 (see here and here)
Security updates to Internet Explorer, Windows apps, Windows graphics, Windows Shell, Windows datacenter networking, Windows virtualization, and Windows kernel.

KB4338815 -- Windows 8.1 Monthly Rollup

Same asÂ KB4338824
Internet Explorer update to conform to the policy that disabled the launch of Developer Tools.
Fixed DNS requests disregarding proxy configurations in IE and Edge (copy and paste gone wrong, Edge not available for Windows 8.1).
Fixed mouse stopped working after switching between local and remote sessions.

KB4338814 -- Windows 10 version 1607

Updates support for the draft version of the Token Binding protocol v0.16.
Fixed form submission issue in IE.
Updates Internet Explorer's Inspect Element feature to conform to the policy that disables the launch of Developer Tools.
Fixed wrong IME mode chosen on an IME-active element.
Fixed DNS requests issue where requests disregarded proxy configurations in IE and Edge.
Evaluates the Windows ecosystem to help ensure application and device compatibility for all updates to Windows (what does that mean?)
Security updates to Internet Explorer, Microsoft Edge, Windows apps, Windows graphics, Windows datacenter networking, Windows virtualization, Windows kernel, and Windows Server.

KB4338826 -- Windows 10 version 1703

Fixed form submission issue in IE.
Updates Internet Explorer's Inspect Element feature to conform to the policy that disables the launch of Developer Tools.
Fixed wrong IME mode chosen on an IME-active element.
Fixed DNS requests issue where requests disregarded proxy configurations in IE and Edge.
Fixed issues with updated time zone information.
Evaluates the Windows ecosystem to help ensure application and device compatibility for all updates to Windows (what does that mean?)
Security updates to Internet Explorer, Microsoft Edge, Windows apps, Windows graphics, Windows virtualization, Windows kernel, and Windows Server.

KB4338825 -- Windows 10 version 1709

Fixed wrong IME mode chosen.
Fixed form submission issue in Internet Explorer.
Fixed DNS requests disregarding proxy configurations in IE and Edge.
Addressed updated time zone information issues.
Fixed a Google Chrome not working issue on Cobalt devices.
Evaluates the Windows ecosystem to help ensure application and device compatibility for all updates to Windows (what does that mean?)
Security updates to Internet Explorer, Microsoft Edge, Microsoft scripting engine, Windows apps, Windows graphics, Windows datacenter networking, Windows virtualization, Windows kernel, and Windows Server.

KB4338819 - Windows 10 version 1803

Microsoft Edge DevTools Preview app allows debugging of WebView content in UWP apps.
Improved Universal CRT Ctype family of functions by correctly handling EOF as valid input.
Addresses an issue that may cause the Mitigation Options Group Policy client-side extension to fail during GPO processing. Error message is "Windows failed to apply the MitigationOptions settings. MitigationOptions settings might have its own log file" or "ProcessGPOList: Extension MitigationOptions returned 0xea".
Evaluates the Windows ecosystem to help ensure application and device compatibility for all updates to Windows (what does that mean?)
Security updates to Internet Explorer, Windows apps, Windows graphics, Windows datacenter networking, Windows wireless networking, Windows virtualization, Windows kernel, and Windows Server.

KB4134651 --Â Security Update for WES09 and POSReady 2009 for x86-based Systems

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory.
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory.

KB4291391 --Â Security Update for Windows Server 2008 and Windows XP Embedded

A denial of service vulnerability exists in the Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses.

KB4293756 --Â Security Update for Windows Server 2008

A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections.

KB4295656 --Â Security Update for Windows Server 2008

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory.

KB4338597 --Â Security Only Update for .NET Framework 3.0 on WES09 and POSReady 2009

KB4338598 --Â Security Only Update for .NET Framework 4 for WES09 and POSReady 2009

KB4338615 --Â Security Only Update for .NET Framework 2.0 on WES09 and POSReady 2009

KB4338820 --Â Security Only Quality Update for Windows Embedded 8 Standard and Windows Server 2012

KB4338830 --Â Security Monthly Quality Rollup for Windows Embedded 8 Standard and Windows Server 2012

KB4338832 -- Adobe Flash Player update

KB4339093 --Â Cumulative Security Update for Internet Explorer

KB4339291 --Â Security Update for WES09 and POSReady 2009

A security feature bypass vulnerability exists when Microsoft WordPad improperly handles embedded OLE objects.

KB4339503 --Â Security Update for Windows Server 2008

An elevation of privilege vulnerability exists when Windows fails a check, allowing a sandbox escape.

KB4339854 --Â Security Update for WES09 and POSReady 2009

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory.

KB4340004 --Â Security Only Update for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows Embedded Standard 7, Windows 7, and Windows Server 2008 R2

KB4340005 --Â Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows Embedded 8 Standard and Windows Server 2012

KB4340006 --Â Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 8.1 and Windows Server 2012 R2

KB4340007 --Â Security Only Update for .NET Framework 2.0, 3.0, 4.5.2, 4.6 for Windows Server 2008

KB4340556 --Â Security and Quality Rollup for .NET Framework 3.5.1 on Windows Embedded Standard 7, Windows 7, and Windows Server 2008 R2

KB4340557 --Â Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows Embedded 8 Standard and Windows Server 2012

KB4340558 --Â Security and Quality Rollup for .NET Framework 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2

KB4340559 --Â Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.5.2, 4.6 on Windows Server 2008

KB4340583 --Â Security Update for Windows Server 2008

A denial of service vulnerability exists when Windows improperly handles objects in memory.

Notes

The release notes list CVEs with FAQs that offer additional information:

Known Issues

Windows 7 SP1

There is an issue with Windows and third-party software related to a missing file (oem<number>.inf). Because of this issue, after you apply this update, the network interface controller will stop working.

Workaround:

LaunchÂ devmgmt.msc, device may appear under Other Devices.
Select Scan for hardware changes from the Action menu.
Alternatively: Right-click on the device and select update. Activate search automatically for updated driver software, or browse my computer for driver software.

Windows 10 version 1709

Localization issues for select strings. The strings may be displayed in English instead of then localized language.

Update: new issue affectsÂ also Windows 10 version 1607

After installing this update on a DHCP Failover Server, Enterprise clients may receive an invalid configuration when requesting a new IP address. This may result in loss of connectivity as systems fail to renew their leases.

Microsoft expects to have a working solution available mid-July.

KB4340558

Users receive a "0x80092004" error when they try to install the July 2018 Security and Quality Rollup update KB4340557 or KB4340558 on Windows 8.1, Windows Server 2012 R2, or Windows Server 2012 after they install the June 2018 .NET Framework Preview of Quality Rollup updates KB4291497 or KB4291495 on systems that are running on .NET Framework 4.7.2, 4.7.1, 4.7, 4.62, 4.6.1, or 4.6.

Security advisories and updates

ADV180002 | Guidance to mitigate speculative execution side-channel vulnerabilities (update)

ADV180012 | Microsoft Guidance for Speculative Store Bypass (update)

ADV180015 | Microsoft Office Defense in Depth Update

ADV180016 | Microsoft Guidance for Lazy FP State Restore

ADV170017 | Microsoft Office Defense in Depth Update (updated)

Non-security related updates

KB2952664 --Â Update for Windows 7

Compatibility update for keeping Windows up-to-date in Windows 7

KB2976978 --Â Update for Windows 8.1

Compatibility update for keeping Windows up-to-date in Windows 8.1 and Windows 8

KB4054529 --Â Microsoft .NET Framework 4.7.2 Language Packs for Windows 7 and Windows Server 2008 R2

KB4054530 --Â Microsoft .NET Framework 4.7.2 for Windows 7 and Windows Server 2008 R2

KB4054533 --Â Microsoft .NET Framework 4.7.2 Language Packs for Windows Embedded 8 Standard and Windows Server 2012

KB4054534 --Â Microsoft .NET Framework 4.7.2 Language Packs for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2

KB4054535 --Â Microsoft .NET Framework 4.7.2 Language Packs for Windows Server 2016, Windows 10 Version 1709, Windows 10 Version 1703, Windows 10 Version 1607, Windows 10 Version 1511, Windows 10 Version 1507, and Windows 10

KB4054542 --Â Microsoft .NET Framework 4.7.2 for Windows Embedded 8 Standard and Windows Server 2012

KB4054566 --Â Microsoft .NET Framework 4.7.2 for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2

KB4054590 --Â Microsoft .NET Framework 4.7.2 for Windows Server 2016, Windows 10 Version 1709, Windows 10 Version 1703, Windows 10 Version 1607, Windows 10 Version 1511, Windows 10 Version 1507, and Windows 10

KB4073120 --Â Microsoft .NET Framework 4.7.2 for Windows Server 2016, Windows 10 Version 1709, Windows 10 Version 1703, Windows 10 Version 1607, Windows 10 Version 1511, Windows 10 Version 1507, and Windows 10

KB4073705 --Â Microsoft .NET Framework 4.7.2 Language Packs for Windows Server 2016, Windows 10 Version 1709, Windows 10 Version 1703, Windows 10 Version 1607, Windows 10 Version 1511, Windows 10 Version 1507, and Windows 10

KB4338852 --Â Dynamic Update for Windows 10 Version 1709

This update makes improvements to ease the upgrade experience to Windows 10, Version 1709.

KB4339277 --Â Dynamic Update for Windows 10 Version 1803

This update makes improvements to ease the upgrade experience to Windows 10, version 1803.

KB4339420 --Â Update for Windows 10 Version 1709

Servicing stack update for Windows 10, version 1709: July 10, 2018

KB890830 --Â Windows Malicious Software Removal Tool - July 2018

Microsoft Office Updates

Microsoft released non-security updates for Office last week. Check out the article in case you missed it.Â You find security releases that Microsoft published today below:

Office 2016

KB4022172 -- Patches a remote code execution vulnerability in Microsoft Office.

KB4022176 -- Same asÂ KB4022172.

KB4018338 -- Security update for Access that resolves vulnerabilities that could allow remote code execution attacks.

KB4022221 -- Skype for Business 2016 update. Fixes remote code execution vulnerabilities.

KB4022218 -- Word 2016 update that patches remote code execution vulnerabilities.

Office 2013

KB4022188 -- Same asÂ KB4022172.

KB4022189 --Â Same asÂ KB4022172.

KB4018351 -- Same asÂ KB4018338

KB4022225 -- Skype for Business 2015 update that fixes remote code execution vulnerabilities.

KB4022224 -- Same asÂ KB4022218 (but for Word 2013)

Office 2010

KB4022200 -- Fixes issues that could lead to remote code execution.

KB4022208 --Â Same asÂ KB4022172.

KB4022206 --Â Same asÂ KB4022172.

KB4022202 --Â Same asÂ KB4022218Â (but for Word 2010)

Other Office products

How to download and install the July 2018 security updates

microsoft windows security updates july 2018

Security updates for client versions of Windows are provided via the built-in updating system Windows Update. Organizations can make use of Enterprise-specific update tools to download and deploy updates.

Updates are also provided as direct downloads on Microsoft's Update Catalog website.

Windows Update, if enabled, checks for new updates regularly but not in real-time. If you want to download and install the new batch of updates directly, do the following to run a manual check for updates (which should pick up the updates).

Note: It is highly recommended that you create a backup before you install new updates so that you may restore the system if things go wrong.

Do the following to run a manual update check:

Tap on the Windows-key to open the Start Menu.
Type Windows Updates and select the result.
Click on the "check for updates" button if the update check is not run automatically.

Direct update downloads

Microsoft publishes downloads of all updates that it releases on the company's Microsoft Download Center website.

Just click on the direct links below to do so.

Windows 7 SP1 and Windows Server 2008 R2 SP

KB4338818 -- 2018-07 Security Monthly Quality Rollup for Windows 7
KB4338823 â€” 2018-07 Security Only Quality Update for Windows 7

Windows 8.1 and Windows Server 2012 R2

KB4338815 â€” 2018-07 Security Monthly Quality Rollup for Windows 8.1
KB4338824 â€” 2018-07 Security Only Quality Update for Windows 8.1

Windows 10 and Windows Server 2016 (version 1607)

KB4338814 â€” 2018-07 Cumulative Update for Windows 10 Version 1607

Windows 10 (version 1703)

Â KB4338826 â€” 2018-07 Cumulative Update for Windows 10 Version 1703

Windows 10 (version 1709)

KB4338825 â€” 2018-07 Cumulative Update for Windows 10 Version 1709

Windows 10 (version 1803)

KB4338819 â€” 2018-07 Cumulative Update for Windows 10 Version 1709

Additional resources

Summary

Article Name

Microsoft Windows Security Updates July 2018 release overview

Description

Microsoft released security and non-security updates for client and server versions of Windows and other products on the July 2018 Patch Day.

Author

Martin Brinkmann

Publisher

Ghacks Technology News

Logo

Comments

The Dark Lady said on July 9, 2023 at 11:19 am


Martin, I would appreciate that you do not censor this post, as it’s informative writing.

Onur, there is a misleading statement “[…] GIFs are animated images …”. No, obviously you don’t seem to have take much notice of what you were told back in March regarding; Graphics Interchange Format (GIF).

For example, https://www.ghacks.net/2023/03/31/whats-gif-explanation-and-how-to-use-it/#comment-4562919 (if you had read my replies within that thread, you might have learnt something useful). I even mentioned, “GIF intrinsically supports animated images (GIF89a)”.

You linked to said article, [Related: …] within this article, but have somehow failed to take onboard what support you were given by several more knowledgeable people.

If you used AI to help write this article, it has failed miserably.
1. E. Fromme said on September 29, 2023 at 1:32 pm
  
  
  EMRE ÇITAK posts are useless because they are fraught with inaccuracies and are irrelevant.
KeZa said on August 17, 2023 at 5:58 pm


AI is stupid, and it will not get any better if we really know how this all works. Prove me wrong.. https://www.youtube.com/watch?v=4IYl1sTIOHI
Database failure said on August 18, 2023 at 5:21 pm


Martin, [#comment-4569908] is only meant to be in: [https://www.ghacks.net/2023/07/09/how-to-send-gifs-on-iphone-two-different-ways/]. Whereas it appears duplicated in several recent random low-quality non relevant articles.

Obviously it [#comment-4569908] was posted: 9 July 2023. Long before this thread even existed… your database is falling over. Those comments are supposed to have unique ID values. It shouldn’t be possible to duplicate the post ID, if the database had referential integrity.
Howard Pearce said on August 25, 2023 at 12:24 pm


Don’t tell me!

Ghacks wants the state to step in for STATE-MANDATED associations to save jobs!!!

Bring in the dictatorship!!!

And screw Rreedom of Association – too radical for Ghacks maybe
Howard Allan Pearce said on September 7, 2023 at 9:13 am


GateKeeper ?

That’s called “appointing” businesses to do the state’s dirty work!!!!!

But the article says itself that those appointed were not happy – implying they had not choice!!!!!!
owl said on September 7, 2023 at 9:50 am


@The Dark Lady,
@KeZa,
@Database failure,
@Howard Pearce,
@Howard Allan Pearce,

Note: I replaced the quoted URI scheme: https:// with “>>” and posted.

The current ghacks.net is owned by “Softonic International S.A.” (sold by Martin in October 2019), and due to the fate of M&A, ghacks.net has changed in quality.
>> ghacks.net/2023/09/02/microsoft-is-removing-wordpad-from-windows/#comment-4573130
Many Authors of bloggers and advertisers certified by Softonic have joined the site, and the site is full of articles aimed at advertising and clickbait.
>> ghacks.net/2023/08/31/in-windows-11-the-line-between-legitimate-and-adware-becomes-increasingly-blurred/#comment-4573117
As it stands, except for articles by Martin Brinkmann, Mike Turcotte, and Ashwin, they are low quality, unhelpful, and even vicious. It is better not to read those articles.
How to display only articles by a specific author:
Added line to My filters in uBlock Origin: ghacks.net##.hentry,.home-posts,.home-category-post:not(:has-text(/Martin Brinkmann|Mike Turcotte|Ashwin/))
>> ghacks.net/2023/09/01/windows-11-development-overview-of-the-august-2023-changes/#comment-4573033

By the way, if you use an RSS reader, you can track exactly where your comments are (I’m an iPad user, so I use “Feedly Classic”, but for Windows I prefer the desktop app “RSS Guard”).
RSS Guard: Feed reader which supports RSS/ATOM/JSON and many web-based feed services.
>> github.com/martinrotter/rssguard#readme
Anonymous said on September 14, 2023 at 6:41 pm


We all live in digital surveillance glass houses under scrutiny of evil people because of people like Musk. It’s only fair that he takes his turn.
Anonymous said on September 18, 2023 at 1:31 pm


“Operating systems will be required to let the user choose the browser, virtual assistant and search engine of their choice. Microsoft cannot force users to use Bing or Edge. Apple will have to open up its iOS operating system to allow third-party app stores, aka allow sideloading of apps. Google, on the other hand, will need to provide users with the ability to uninstall preloaded apps (bloatware) from Android devices. Online services will need to allow users to unsubscribe from their platform easily. Gatekeepers need to provide interoperability with third-parties that offer similar services.”

Wonderful ! Let’s hope they’ll comply with that law more than they are doing with the GDPR.
sean conner said on September 27, 2023 at 6:21 am


No, they didn’t lmao.

https://twitter.com/vxunderground/status/1706523877478670542
Sherry Grant said on September 29, 2023 at 7:47 pm


What does this article about Musk/Tesla have to do with computing, devices, phones?
More irelevant filler.
Anonymous said on September 29, 2023 at 8:47 pm


yeah sure… they are always the victims and it is only against them ????

Believe them 100% and never question anything. This lawsuit sounds like the type you heard when people were eating batteries.

Microsoft Windows Security Updates July 2018 release overview