Posts made by Tom

Hi,

Well, this is indeed a bit of a challenge, since 3.0.13 is some what "official", in the sense, that it is a available from one of their download sites, the installer and the exe are signed by the publisher.

And we did see a few other users who installed it already last week.

Also, @OLLI_S sent me this article (how could he forget that already? getting old?):
https://positive.security/blog/url-open-rce

So it is also strongly indicated that 3.0.13 is fixing a vulnerability, though, that isn't official - yet.

Had it not been for the potential security fix, then we would not have recommended it yet.

@gregalexandre I don't know how Python is utilized by Yubikey Manager, so it is hard to assess if it is affected by the vulnerability in Python.

Unless Yubikey (or some independent researcher) makes any statements that indicate Yubikey Manager to be affected, then we will not flag it as being affected.

For some "libraries" it is dead obvious whether the "parent" product is affected (or not) by a vulnerability, but in a case like this, it is dependent upon their specific implementation of Python (and I have no knowledge about how they use it). The same goes for many applications that utilize Java.

Given the latest vuln that was fixed in Python, I wouldn't worry much though.

@gregalexandre It does get updated separately from Edge, but it is done silent, so most users won't ever notice.

@gregalexandre Thank you

The issue is that the latest official release is "13901.20312", we do suspect that 13901.20336 will be official on Monday or Tuesday, but until it is officially announced on the official "Update history for Microsoft 365 Apps" page, then we will leave it as "Unknown".

If this will be "standard" procedure for Microsoft to release it days before it is officially "announced", then we may start to track it differently (but historically we have seen that they have issued a new release to few users, just to release a new bug fix and complete "forgetting" about the other one - IMO that qualifies for "Unknown").

@olli_s Looks like it is "good to go". No longer flagged as Internal.

@olli_s Now

@olli_s Thank you, that was funny, it is now corrected

@olli_s Now, thank you

I will see if I can do something about the download link, however, the state of WebView appears to be correct.

It is important to note that WebView is a "standalone" component, that is updated separately from Edge.

Depending on which 3rd party apps you have that use WebView, the attack vectors may be somewhat limited, compared to the Edge browser when it is being used to visit arbitrary pages.

You can download the update from here, until we update the download link for WebView:
https://developer.microsoft.com/en-us/microsoft-edge/webview2/#download-section

@gregalexandre Thank you again.
I have just instructed the curator who updated the latest rule for DiskInfo, to remember to set the special flag that handles this correctly.

@olli_s I much prefer Microsoft Office, but clearly, Microsoft sees it differently:
https://docs.microsoft.com/en-gb/deployoffice/name-change

We were slow to adapt the new name, as nobody complained, and frankly, I think many people, like you, are more confused by the new name.

However, Microsoft 365 Apps is the new official name, so we decided to go with it as well.

Feel free to complain to Microsoft

@gregalexandre And the fix is out!

Thank you

@gregalexandre And thank you for reporting this.

@gregalexandre My apologies for my ignorance, it seems we pushed some code changes that affected multiple personal users.

We are fixing it right away, the fix should go out later today.

@olli_s If you see the right result, then all should be good.

We added the "translation" of "2009" => "20H2" long time ago, and if it already says "20H2", then we leave it as is.

So I think it is safe to close this, else I am sure you will make a new post if you see other odd changes in Microsoft versioning

@olli_s

Great you stumbled upon this. And super funny that you wrote this about SUMo.

It indicates that they have the same "misinterpretation" about Office, that we also had for a long time.

We started restructuring and redoing the entire Office ruleset some weeks ago, in fact, we have taken all releases from 2016 until today and rewrote all of them.

So now the results are vastly more accurate. Unfortunately, we had created a "deadend" which your two inspections fell into.

This is now fixed, so they will appear as "Unknown" until we have added the correct rule. Normally, we would have shown it as "OK", but due to the way we have to handle Office, we are doing all rules by hand, and if you are too fast in updating, you will see this briefly. It will still make it to our internal "to do", so we will get too it quickly, and show the correct result upon the next scheduled inspection.

@olli_s It appears that your OfficeClickToRun.exe is gone, or perhaps some properties has changed.

Is is usually located in this folder:
C:\Program Files\Common Files\microsoft shared\ClickToRun

Can you try to look for this file and perhaps extract the details from it using your Toolbox?

@gregalexandre We did an intentional server failover around that time, I presume that is what caused it.

However, if you refresh using F5, then the issue should disappear after 30-60 seconds.

If you encounter this again, and it doesn't fix itself after approx 1 minute, then please do let me know.

@gregalexandre Ahh, yes, that is because you were faster than our curator

We've optimized the rule, so next time it won't show the "recommended".

However, it will briefly show the full a.b.c.d until we create a rule, after this the displayed version should be a.b.c.

@GregAlexandre You are right, our current "recommendation" is also based on the version released by HARMAN and we do monitor their website for new releases.

We have now split the product, to correctly state that HARMAN is the vendor for 33.x.

32.x and older are still Adobe, but flagged as EoL.

Do let me know if this doesn't look correct on your end.