Windows 2003 Service Pack 2 Hotfixes compiled by the_guy (April '07 - Aug '08) and FDV (Sept '08 - forward)
Windows 2003 comes with version IE 6. Be careful not to mismatch IE version and hotfixes.
Windows 2003 Service Pack 2 Hotfixes compiled by the_guy (April '07 - Aug '08) and FDV (Sept '08 - forward)
Windows 2003 comes with version IE 6. Be careful not to mismatch IE version and hotfixes.
No, I'm not linking IE 7, IE 8, or whatever other train wrecks Microsoft is releasing unless the v6 link happens to be the exact same (like cumulatives).
A server OS shouldn't even have a browser in it, never mind an HTML engine. It's a SERVER!
Start here:
Service Pack 2 for Windows Server 2003
April 2007:
925902 - OBSOLETE. Vulnerabilities in GDI Could Allow Remote Code Execution
932168: Vulnerability in Microsoft Agent Could Allow Remote Code Execution
930178: Vulnerabilities in CSRSS Could Allow Remote Code Execution
931784 - OBSOLETE. Vulnerability in Windows Kernel Could Allow Elevation of Privilege
June 2007:
924667: Vulnerability in Microsoft Foundation Classes could allow for remote code execution
935840 - OBSOLETE. Vulnerability in the Windows Schannel Security Package Could Allow Remote Code Execution
929123: Security Update for Outlook Express and Windows Mail
935839 - OBSOLETE. Vulnerability in Win 32 API Could Allow Remote Code Execution.
July 2007:
933854: Description of the security update for the .NET Framework 1.1 for Windows Server 2003
936357: A microcode reliability update is available that improves the reliability of systems that use Intel processors
August 2007:
936227 - OBSOLETE. Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
October 2007:
933729 - OBSOLETE. Vulnerability in RPC Could Allow Denial of Service
November 2007:
943460 - OBSOLETE: Vulnerability in Windows URL Handling Could Allow Remote Code Execution
December 2007:
944653: Vulnerability in Macrovision driver could allow local elevation of privilege
January 2008:
943485 - OBSOLETE. Vulnerability in LSASS Could Allow Local Elevation of Privilege
February 2008:
942831: Vulnerability in Internet Information Services could allow elevation of privileges
942830: Vulnerability in Internet Information Services could allow remote code execution
946026: Vulnerability in WebDAV Mini-Redirector could allow remote code execution
947890: A vulnerability in OLE Automation could allow remote code execution
April 2008:
945553: Vulnerability in DNS Client Could Allow Spoofing
948590 - OBSOLETE. Vulnerabilities in GDI Could Allow Remote Code Execution
941693 - OBSOLETE. Vulnerability in Windows Kernel Could Allow Elevation of Privilege
June 2008:
951698 - OBSOLETE. Vulnerabilities in DirectX Could Allow Remote Code Execution
948745 - OBSOLETE. Vulnerability in WINS Could Allow Elevation of Privilege
953235 - OBSOLETE. This actually links to KB949014 and KB949269. Vulnerability in Active Directory Could Allow Denial of Service
950762: Vulnerabilities in Pragmatic General Multicast (PGM) Could Allow Denial of Service
942288: (download, bulletin) Windows Installer 4.5 Redistributable
July 2008:
953230: This actually links to KB951748. Vulnerabilities in DNS Could Allow Spoofing
August 2008:
952954: Vulnerability in Microsoft Windows Image Color Management System Could Allow Remote Code Execution
951066: Security Update for Outlook Express and Windows Mail (does not replace 929123)
950974: Vulnerabilities in Event System Could Allow Remote Code Execution
953839 - OBSOLETE. Cumulative Security Update for ActiveX
938127: Vulnerability in Vector Markup Language Could Allow Remote Code Execution
September 2008:
943729: Group Policy Preference Client Side Extensions
954593 - OBSOLETE. Vulnerabilities in GDI+ Could Allow Remote Code Execution
938464 - OBSOLETE. Attacker could remotely compromise Windows system that uses GDI+ and gain control over it
October 2008:
956391 - OBSOLETE. Cumulative security update for ActiveX
956803: Vulnerability in the Microsoft Ancillary Function Driver Could Allow Elevation of Privilege
956841 - OBSOLETE. Vulnerability in Virtual Address Descriptor Manipulation Could Allow Elevation of Privilege
957095 - OBSOLETE. Vulnerability in SMB Could Allow Remote Code Execution
953155: Vulnerability in Windows Internet Printing Service Could Allow Remote Code Execution
954211 - OBSOLETE. Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege. (see also 959252 below in November 2008)
958644: Vulnerability in Server Service Could Allow Remote Code Execution
340178: Windows Server 2003 Service Pack 2 Administration x86 Tools Pack - update
November 2008:
957097 - OBSOLETE. Vulnerability in SMB Could Allow Remote Code Execution
955218: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution
958655: Update to resolve an issue in MSI Installer 4.5
959252: Update to resolve an issue in which you receive a 0x0000008e Stop error after installing 954211
December 2008:
955839 - OBSOLETE. Time Zone Updates
956802: Vulnerabilities in GDI Could Allow Remote Code Execution.
January 2009:
958687 - OBSOLETE. Vulnerabilities in SMB Could Allow Remote Code Execution
February 2009:
There were no fixes for the OS in February 2009.
March 2009:
960225: Vulnerability in SChannel Could Allow Spoofing
967715: A new shell32.dll file correcting "disable Autorun registry key" enforcement
958690 - OBSOLETE. Vulnerabilities in Windows Kernel Could Allow Remote Code Execution
April 2009:
959454: Vulnerabilities in Windows could allow elevation of privilege. This is broken into two downloads to piss you off. Click here for the first one called "KB952004"
959454: Vulnerabilities in Windows could allow elevation of privilege. This is broken into two downloads to piss you off. Click here for the second one called "KB956572"
959426: Blended threat vulnerability in SearchPath could allow elevation of privilege
960803 - OBSOLETE. Vulnerabilities in Windows HTTP services could allow remote code execution
960477: Vulnerability in WordPad and Office text converters could allow remote code execution
961373 - OBSOLETE. Vulnerability in Microsoft DirectShow could allow remote code execution
May 2009:
There were no fixes for the OS in May 2009.
June 2009:
971055 - OBSOLETE. Vulnerabilities in Active Directory Could Allow Remote Code Execution
961501: Vulnerabilities in Windows Print Spooler Could Allow Remote Code Execution
963093: Vulnerability in Windows Search Could Allow Information Disclosure
970238: Vulnerability in RPC Could Allow Elevation of Privilege
968537 - OBSOLETE. Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
970483: Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation of Privilege
July 2009:
961371 - OBSOLETE. Vulnerabilities in the Embedded OpenType Font Engine Could Allow Remote Code Execution
973346 - OBSOLETE. Cumulative Security Update of ActiveX Kill Bits
971633 - OBSOLETE. Vulnerabilities in Microsoft DirectShow Could Allow Remote Code Execution
970653 - OBSOLETE. Resolves issues caused by revised daylight saving time and time zone laws in several countries
August 2009:
973908: Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution
973354 - OBSOLETE. Outlook Exporess update
973869: (download, bulletin): DHTML editing component ActiveX control
973815: (download, bulletin): Microsoft MSWebDVD ActiveX Control
971557 - OBSOLETE. Vulnerabilities in Windows Media File Processing Could Allow Remote Code Execution
969883: Vulnerabilities in WINS Could Allow Remote Code Execution
971032: Vulnerability in Message Queuing Could Allow Elevation of Privilege
971657: Vulnerability in Workstation Service Could Allow Elevation of Privilege
960859: Vulnerability in Telnet Could Allow Remote Code Execution
970927: Vulnerabilities in Remote Desktop Connection Could Allow Remote Code Execution
973811: Link 1 (explanation), Strengthens authentication credentials in specific scenarios
968389: Link 2 (reg setting), Strengthens authentication credentials in specific scenarios
968389: Link 3 (download), Strengthens authentication credentials in specific scenarios
September 2009:
956844: Vulnerability in DHTML Editing Component ActiveX Control
967723: Vulnerabilities in Windows TCP/IP Could Allow Remote Code Execution
October 2009:
973525 - OBSOLETE. Cumulative Security Update of ActiveX Kill Bits
958869: (download, bulletin): Vulnerabilities in GDI+ Could Allow Remote Code Execution
971486 - OBSOLETE. Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
969059: (download, bulletin): Vulnerability in Indexing Service Could Allow Remote Code Execution
975254: (download, bulletin): Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution
974571: (download, bulletin): Vulnerabilities in Windows CryptoAPI Could Allow Spoofing
975467: (download, bulletin): Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service
November 2009:
969947 - OBSOLETE. Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
973309: Link 1 (explanation), Vulnerability in Active Directory Could Allow Denial of Service
973037: Link 2 (download 1), Vulnerability in Active Directory Could Allow Denial of Service
973039: Link 3 (download 2), Vulnerability in Active Directory Could Allow Denial of Service
December 2009:
975539: (download, bulletin): Vulnerability in WordPad and Office Text Converters Could Allow Remote Code Execution
974392: (download, bulletin): Vulnerability in LSASS Could Allow Denial of Service
974318: (download, bulletin): Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution
955759: (download, bulletin): AppCompat update for Indeo codec
971737: (download, bulletin): Update that implements Extended Protection for Authentication in Microsoft Windows HTTP Services (WinHTTP)
970430: (download, bulletin): Update that implements Extended Protection for Authentication in the HTTP Protocol Stack (http.sys)
971726: (download, bulletin): Authenticated remote attacker could gain control over system
973917: (download, bulletin): Extended Protection for Authentication in IIS
January 2010:
972270: (download, bulletin): Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution
February 2010:
971468 - OBSOLETE. Vulnerabilities in SMB Server Could Allow Remote Code Execution
975713: (download, bulletin): Vulnerability in Windows Shell Handler Could Allow Remote Code Execution
977165 - OBSOLETE. Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
977935: Link 1 (explanation): Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution
977914: Link 2 (download, bulletin): Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution
975560: Link 3 (download, bulletin): Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution
978037: (download, bulletin): Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege
978251: (download, bulletin): Vulnerabilities in SMB Client Could Allow Remote Code Execution
978262 - OBSOLETE. Cumulative Security Update of ActiveX Kill Bits
978706: (download, bulletin): Vulnerability in Microsoft Paint Could Allow Remote Code Execution
976569: (download, bulletin): Update to Dotnet 2 SP2 issued February 22nd
March 2010:
979306: (download, bulletin): Revised daylight saving time and time zones
973917: (download, bulletin): Strengthen authentication credentials
Please note! As of April 2010, hotfix KB numbers often bear absolutely no relationship whatsoever to the actual KB. In other words, as an actual example, clicking on either KB979309 or KB978601 will bring you to KB981210. Going forward I will list the actual KB.
April 2010:
980232: (download, bulletin): Vulnerabilities in SMB Client Could Allow Remote Code Execution
979683: (download, bulletin): Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
981169: (there are THREE downloads, go to bulletin, bulletin): Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution
978338: (download, bulletin): Vulnerability in Windows ISATAP Component Could Allow Spoofing
977816: (download, bulletin): Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution
981832: (download called 976323, bulletin): Vulnerabilities in Microsoft Exchange and Windows SMTP Service Could Allow Denial of Service
981210: (download 1 called 979309, bulletin): Vulnerabilities in SigVerif and CABview Could Allow Remote Code Execution
981210: (download 2 called 978601, bulletin): Vulnerabilities in SigVerif and CABview Could Allow Remote Code Execution
May 2010:
978542: (download, bulletin): Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution
June 2010:
979559 - OBSOLETE. Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege
980195: (download, bulletin): Security Update for ActiveX Killbits
980218: (download, bulletin): OpenType Compact Font Format (CFF) Driver Could Allow Elevation of Privilege
982666: (download, bulletin): Vulnerability in Internet Information Services
Additional multimedia fixes are below.
July 2010:
2229593: (download, bulletin): Vulnerability in Help and Support Center Could Allow Remote Code Execution
August 2010:
2286198: (download, bulletin): Vulnerabilities in Windows Shell Could Allow Elevation of Privilege
980436: (download, bulletin): Vulnerabilities in Windows SChannel Could Allow Elevation of Privilege
982316: (download, bulletin): TAPI Update
2160329: (download, bulletin): Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege
982214: (download, bulletin): Vulnerabilities in SMB Server Could Allow Remote Code Execution
2115168: (download, bulletin): Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution
2079403: (download, bulletin): Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
2264107: (download, bulletin): A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm (it's about fucking time)
September 2010:
xxxxxx: (download, bulletin): descrip
Other Windows Components: Internet Explorer 6, 7, 8
Obsolete hotfixes will not be listed, as this changes too often.
2183461: (download, bulletin): Cumulative Security Update for Internet Explorer
Other Windows Components: Javascript
971961: Jscript 5.6, Jscript 5.7, Jscript 5.8 (all three are at this link)
Other Windows Components: Media Player
925398: July 2007. Vulnerability in Windows Media Player 6.4 could allow remote code execution
936782: August 2007. Vulnerability in Windows Media Player Could Allow Remote Code Execution
941569: December 2007. Vulnerability in Windows Media file format could allow remote code execution
944275: December 2007. Vulnerability in Windows Media file format could allow remote code execution
954156: September 2008. Security Update for Windows Media Encoder 9 Series
954600, 952068, 952069: December 2008. Security fixes for Media Player
959807 - OBSOLETE. Vulnerabilities in Windows Media Components Could Allow Remote Code Execution
968816: Security Update for Windows Media Format Runtime 9.5
972554: (Another, different) security Update for Windows Media Format Runtime 9.5
974112 (download, bulletin): Vulnerability in Windows Media Player Could Allow Remote Code Execution
975682: Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution. 975682 is comprised of the following three hotfixes:
969878 (download, bulletin): - Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution
954155 (download, bulletin): - Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution
975025 (download, bulletin): - Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution
979332: (download, bulletin): Windows Media Encoder 9 Series
979482: (download, bulletin): Vulnerabilities in Media Decompression Could Allow Remote Code Execution, 1
975562: (download, bulletin): Vulnerabilities in Media Decompression Could Allow Remote Code Execution, 2
979902: (download, bulletin): Vulnerabilities in Media Decompression Could Allow Remote Code Execution
Roots Update direct download link last updated September 25 2007
Windows Script 5.7.0.16535 direct download link
MS Server 2003 link that changes hourly and will probably be a 404 before I even finish typing this
Please post any issues with this list here.