Slashdot Mirror
MS Patch Train Leaves the Station
per1176 writes "Microsoft has released 10 advisories to cover a dozen security vulnerabilities, including a "critical" cumulative update for the Internet Explorer browser. The IE fix corrects a remote code-execution vulnerability that exists due to the way the browser handles PNG (Portable Network Graphics) files."
Ill stick to firefox thankyou.
Does this fix the crash with large streched images?
ie width=9999999 height=999999 in an
That's hilarious, because IE barely supports PNGs at all, but they apparently are vulnerable to them nonetheless. If you don't know of the png problem, they just don't display the colors right and/or won't do transparencies right at all.
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
but is there an obvious point where software become more patch then content?
Lately I envision all Microsoft products as lumbering stay-puff marshmallow men, ambulating labored steps inside a comical suit of band-aids.
:::: the insomniac's digest
Why not just release a patch that uninstalls IE?
After the jpg incident, wouldn't you tend to look at the code handling other image formats for similar problems? Guess not.
Well, this would bring the grand total of hours spent on windows update a bit further... I'm switching to Mac! :P
--MaxPowerDJ
Okay, I'm not familiar with IE's internals. But I still cannot understand how you'd introduce a remote execution vulnerability into "get PNG bits, arrange bits for display system" unless you were *trying* for that. Yeah, I know you have to allocate memory for the PNG, and I understand the problem probably comes from an overflow of that, but still, it makes me wonder just how badly written this stuff must be.
Microsoft has released a free security update to Windows users today: Service Pack Linux. Service Pack Linux includes a fix for all IE vulnerabilities, as well as flaws in Outlook and Office. IIS users will be happy to know that Service Pack Linux will fix many problems with Microsoft's premier web server package as well. Service Pack Linux is considered the most comprehensive security fix in Windows history. Users should get it now at http://distrowatch.org/
-py
http://www.us-cert.gov/cas/techalerts/TA05-136A.ht ml
Best Buy can have you arrested
Is this really still "insightful" on Slashdot?
I thought they might have fixed the png transparency bug, which was reported to them eight years ago... but no... just a buffer overflow.
For those admins who tend to a small MS shop and don't have the need for an expensive patch management solution, WSUS was released last week to replace the lame SUS (Software Update Services). I had to disable SUS due to some GPO issues, so I'm looking forward to checking out WSUS. And with this round of patches, it seems like the ideal time to test.
Entrepreneur : (noun), French for "unemployed"
Never needed MSFT to put in a "backdoor" for them, specifically. Christ, they just needed the source-code so they could use all the ones there were already there.
Your problem is that you listen to Kim Commando in the first place. :P
Any new on latest FireFox vulnerabilites? Have they been patched?
Is that anything like Soul Train?
IGB: More fun than eating oatmeal!
You'd think.
It's crap like this that makes me wonder at the possibility of Apple eating Microsoft's lunch on the OS front.
Sorry, I don't use linux and I openly profess my general ignorance.
That obviously makes me a minority around here. Twice over, in fact.
:::: the insomniac's digest
Ehh?
I don't believe you.
You'd better go here and install the Fedora updates (three in the last month)!
Best Buy can have you arrested
You just started using your linux box & already started acting up? Wait till the next 'Core' is released by Fedora. You'll have to format & install everything again as most 'Cores' have a habit of breaking everything in their sight.
And, do I need to remind you about stability issues with Debian Sarge? I give you that Windows isn't an epitome of security, but ignoring FOSS issues & just plainly bashing is stupid.
exists due to the way the browser handles PNG (Portable Network Graphics) files."
/frustrated by lazy programmers
Hmm... Buffer overflow maybe?
Buffer overflow is an amateur mistake. Check your god damn code.
But honestly, anyone who complains about patches is, IMO, crazy. Would you rather they didn't patch at all???
The Kim Commando show? Seriously, that show sounds like they put a phone in a mental institution and let the patients phone in. Please don't use that as your proxy.
Finance tutorials and more! Understandfinance
While they're messing with PNGs, they might as well fix their horrible support for the thing. Ever tried using transparency in IE? Boy doesn't that look nice. Cocksuckers.
It's happened to me twice now...
I'll install a vanilla copy of XP Pro onto a system, and within minutes of hooking the machine up to the network, it has become infected with a virus, basically requiring a reinstallation immediately.
My normal mode of installation is:
- Install XP
- Two IE windows open:
- One downloads Firefox
- The other goes to Windows Update and starts downloading patches.
- Download everything else using firefox, including drivers, etc.
But apparently Windows Update isn't a fast enough method to get the machine patched, and the machine is compromised before the appropriate patches are finished being applied.
I've made a "XP Install Disc 2" for myself, which has the full SP2 installer file, Firefox, Avast, Spybot, and Adaware on it, that I then install while the box is still offline. It seems that SP2 does well enough at plugging exploits that the system then has enough time to download the other patches normally without becoming compromised.
Does anyone have a better solution?
A humor security issue has been identified that could allow a Slashbot to remotely compromise your sense of humor about Windows patches and bore you to death. You can help protect your sense of humor by installing this update from Microsoft. After you install this item, slashdot.org will resolve to 127.0.0.1 .
How to Uninstall
Read all comments rated as funny under a story about Windows Update on slashdot.org and your sense of humor will be successfully uninstalled.
Help and support
http://omgmstehsux0rs.slashdot.org/
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
MS releases a patch and it's news?
One ring to bind them - should probably have more fiber and less rings in their diet.
Stop running M$ ads! U look like ur 0wned by M$.
The amount of "CPU time" "Windows users" spend patching holes is a few minutes every month. And get off your high horse, here: while Linux distros provide updates for a more comprehensive range of apps, it's also the case they you have to download far more (in terms of raw megabytes) far more often. I'm willing to bet right now that, timing from the release of FC3, FC3 has required more and bigger updates than Windows.
I'll never forget the time, earlier this year in fact, when Mandrake provided a security "update" for the kernel (you may remember the much-publicized priviledge escalation vulnerability around the end of last year). This "patch" consisted of the whole kernel source (maybe 40MBs of it) which you would have to manually compile and install (no nice binary rpm, here). With this one single update, Mandrake users have exceeded the "CPU time" required for a few months of Windows updates. And let's not forget the hefty kdelibs security updates, which basically amounts to downloading the whole of kdelibs again, since none of the distros seem to provide diff-style patching. The same with Firefox (8MB on Linux...?).
Also, while we are free from worms and viruses here, note that there is nothing innate to Linux that precludes phishing and spoofing attacks.
Ugh.Want good tech radio? listen to Leo Lapporte on KFI on the weekends
train I don't ride anymore - thank goodness.
goodbye billy and steve - have fun with your os. glad you are thinking about security.
> And, do I need to remind you about stability issues with Debian Sarge?
Yes. No problems here...
You don't do updates then? Not even when the super-responsive OSS community bangs out streams of emergency fixes for bugs? Not even when a tiny fraction of those quick, small fixes close security holes?
Colleagues of mine used to run Linux like that. Their machines got rooted three times before they changed their minds.
1. Why is it news when MS releases a patch? It happens every week.
2. First a JPG problem, then a PNG problem, so what's next? A GIF and a BMP problem? Or are we moving onto video formats next?
~Ilyanep
To get message, take amount of carrier pigeons at each stage mod 2. Then decode binary.
Yes. Everything that glorifies Applè, Mozillá or Göôgle makes the über-sexy moderators release a trickle of greasy semen in their smelly Debian-thong.
If you look at Macintosh, BSD, and Linux distributions, they also have regular security updates, with many similar vulnerabilities.
There are really two problems here, one true of all major OSes right now, and the other one true of proprietary systems.
The first problem is the pervasive use of C and C++, which makes systems unnecessarily prone to buffer overflows and related problems. C and C++ programmers keep saying that they can handle it, but it is obvious that they can't.
The second problem is that Microsoft and Apple only update their own applications; users are saddled with downloading updates for other software by hand. If all these bugs exist in IE, you can be similar bugs exist in Photoshop, Office, and many other apps that aren't automatically updated.
Otherwise known as the Bugwarts Express. To find the boarding platform, run your luggage cart full tilt into that blue screen.
Don't blame Durga. I voted for Centauri.
I use mandrake, I have since 9.0. I have _never_ had to compile the kernel from source. You urpmi the source from the command line. The mcc interface will NOT install the kernel automatically. You have to do it manually.
In older distributions, you would simply type urpmi kernel (or whichever of the other kernel's you're using, like enterprise, etc.). In the recent mandriva releases, you have to type urpmi kernel-2.6
Obviously you haven't been using linux often... Where did you get the impression that you "had" to compile it from the source package?
Maybe as an engineer who uses computers to actually accomplish something I just have a different point of view.
Or maybe you're just a pretentious holier-than-thou asshole who doesn't realize that some of us use Windows because that's what our products are delivered on, or we need a piece of legacy software to do our work, or our kids have Windows-only games, or we've never heard of Linux so we don't know there's alternatives to Microsoft, or our bank requires IE, or any of the other thousand and one reasons some people use it.
There's no need to assume we're all idiots, you know.
PS. phishing and spoofing are platform-agnostic. Without the right knowledge, your grandma would get owned by PayPal scammers no matter if she ran Windows or Warty (or anything else, for that matter).
the coolest club on
We can't go back to gif, can we? ;-)
Exercise caution when modding this message up: the author acts like a jerk when his karma is excellent.
Currently getting FC4 to install, but, actually I mainly practice safe networking with a Linksys router/firewall at work and an OpenBSD gateway at home. The point is I like to use a computer for computing and getting work done. When I was a Windows admin several years ago it was a daily/weekly event for employees to come running in worried about the latest vuln. attack they heard on the news - I can completely do without all that static and distraction, it just seems to come with the "Windows culture", which came from their long standing practice of releasing not ready for prime-time software and then patching it later in the field, because it's legal to do so and they could get away with it.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
It's the Paaaaaaaaaatch Train! The longest running update progam in computer history. Now with your host Steve Ballmer!
Thalasar
If MS doesnot patch you all say "MS wont patch their crappy stuff"
if they do patch, you all say "Wow, it must suck really bad to have to patch it"
As if Linux doesn't require constant patching either, hypocrites
Torrent here http://linuxtracker.org/download.php?id=306&name=f reeduc-games-1.6-qemu-0.6.1-2.iso.torrent
I mainly practice safe networking with a Linksys router/firewall at work and an OpenBSD gateway at home.
Does your firewall block outgoing HTTP connections and incoming email? If not, then it's not going to help against attacks like this PNG bug which are propagated through user-pulled data rather than attacker-pushed port connections. Such attacks exist for Linux, too. There is no such thing as "safe networking", and the only way to come close is to keep every connected computer up to date. I think Fedora still comes with up2date searching for updates in the background and displaying the results on a panel icon. Unless you use something else for security updates you ought to be clicking on that every time it finds something new.
This is all partly as a result of the way the PC platform itself works, it's merely that Windows has got so much compound crap in its code that these things are bound to happen. As Linux distros continue to grow and mutate and people ignore the old idea of the smallest kernel possible, we're going to see more buffer overflow errors on Linux. If BSD had the same kind of useage rates as Linux, we'd see a similar trend there. Mac OSX is taking off, we're going to see evolutionary crap in its genetic structure as it were.
Tearing Windows present design platform down to the smallest parts and scrubbing and rebuilding would probably put back the release of XP's successor to 2016. Let's hope some people are listening on the Linux and OSX sides and get it in their heads to keep their code lean and healthy and well tested.
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
Does it look anything like this?
Microsoft has announced that Internet Explorer will now be a part of the Apache Foundation. The new name will be Apache Browser.
Comment removed based on user account deletion
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
And the alternative is a jackass...need I say more?
you mean there's going to be MORE train crashes?
Here comes the pain train
I just installed the latest update for windows 2000 on my wife's computer and it hosed the installation. I assume it included these latest patches. Has anybody had a similar experience? I am getting a "SYSTEMced corrupt or missing" error which google tells me has to do with registry problems.
apparently so. Maybe the moderators should realize that we get a little icon that pops up telling us it is there hours before the story even gets posted. Just imagine if we had a slashdot story for every *nix patch as well. We would be nothing but patchdot.org. I'm sick of these and the stories about how something is 1 yr older.
Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.
Fedora never has any updates or patches. Nope. Never Only Windows has patches.
Even Mac OS X doesn't have security updates.
That's right, there is no absolutely, guarenteed, bullet-proof 'safe networking' - but there is SAFER and RISKIER, and I feel much more comfortable with the level of risk in this box than exists with any M$ft product. Are there vulnerabilities on this box? Most certainly. Have there been any incidents? No, zero, none, nada. Am I going to chew my fingernails off and live in a perpetual state of paranoid anxiety worrying about potential exploitz? Nope.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
I'm surprised no one has yet mentioned the problem one of these "critical updates" is causing on Dell Optiplex GX280 computers. I had two systems on my LAN mistakenly configured with "automatic updates" that had serious problems after one of these updates was installed. The user complained that they would turn on the computer and after about 10 seconds (before they could even finish logging on) their monitor would turn off. I first thought it was a monitor problem, but changing monitors didn't resolve the issue, so I called Dell Corporate/Gov't. Tech Support. Before I even got through the menus to a live body, there was a message on the line suggesting that if you were having video problems on Optiplex systems after installing the Critical Update, you should re-boot the system in VGA mode and change the default resolution to 800 X 600. Apparently, one of these updates re-sets default resolution to a range that cannot be supported with the built-in video hardware on the Optiplex.
Once you re-boot in a low resolution, you can then re-set the default resolution to something more acceptable (say, 1024 X 768 or something similar) and you're golden, but I have seen nothing in the press about this bug (that took me well over an hour to puzzle out on both affected computers).
My other systems are configured for SMS control, so patches aren't rolled out before testing, but these were set up to Auto Update (which Microsoft recommends for everyone, despite problems such as this). Otherwise, this could have been a major headache yesterday.
"Vendors should never, ever roll back changes into older versions of their software they force you to use."
Fixing PNG support in IE 6 now wouldn't make much sense. Web designers would have just have yet another browser variant to worry about.
If they started to design sites with transparent PNGs, they still wouldn't be able to say "This site works in IE 6" because it will only work for those who have a certain patch.
I'm not saying I like the situation, and I certainly think they should have gotten it right in the first place, but they can't just go and change the way their browser treats content any time they feel like it.
Full PNG support in IE WILL make a big impact on the web, and they can't just add that in a minor patch.
>>>need I say more? Yes you do, please say more
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
Maybe as an engineer who uses computers to actually accomplish something I just have a different point of view.
Ugh.
I would agree this is an awkward way of putting it -- but stressing the different usage-patterns of your typical engineer vs your typical joe 6p is in itself a valid point, I would say. There is a point where insisting things being in some respect "equal" is self-defeating.
Recognizing a difference does not necessarily invalidate one or the other "variant," in fact it often allows the best to emerge in each.
I guess what I mean is that, though perhaps poorly worded, my GP actually just pointed out the different usage patterns, but perhaps was not actually saying that computing the "joe 6p way" is inferior somehow. Just different, is all.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
A "release train" is a common term for a system where coordinated sets of updates for multiple products are released at regular intervals (theoretically, all the updates in one release tested to work with each other). Therefore, it would seem that "patch train" pretty accurately describes Microsoft's monthly patch release scheme. Calling publication of this patch train "Leaving the station" doesn't strike me as being any kind of editorializing.
Possibly - God knows I'm always putting my foot in my mouth whenever I go off on one of my rants :) One of the perils of a communication medium where all of the usual verbal cues and body language are removed, I guess...
"...putrid arrogance and condescension..."
m ageLoader (src='image.png', sizingMethod='scale')" />
Sad little man. The previous poster wasn't calling you a sheep, but I will. Sure, you can run Windows because it 'Just sucks...err....works out of the box' and be constantly on your guard against the mentioned spyware, malware, trojans, viruses, etc. The plain fact is that OSS bugs and security flaws are generally less damaging, less frequent and resolved faster than the flaws in MS products.
You completely failed to mention Gentoo when trying to rip Linux. My updates can be several hundred MB in size, but I don't mind. It is the price I gladly pay for software that 'just works, and works the same every time.' For 20+ Linux systems and servers, I download a new source package once. Centralized NFS distfiles directory prevents me from wasting valuable time downloading the same update on every machine. Do I need to mention how Windows handles this situation? There are obvious advantages to using Linux (as well as other FOSS) that many MS evangalists REFUSE to see.
"I beg you to come unto me, brothers and sisters. I have seen the light and I can lead you to your salvation or possibly your doom...."
Weren't we talking about PNG on IE before? Someone mentioned the transparency issue in a different thread, which can be resolved with this code:
<img src="blank.gif" style="width: 100px; height: 100px; filter:
progid:DXImageTransform.Microsoft.AlphaI
You may want to implement browser specific insertion of that code...it totally doesn't work in anything but IE
Word!
"Lame" - Galaxar
none of the distros seem to provide diff-style patching.
Suse 9.3 does, as I'm on dialup it's a godsend.
As it's now GPL I wish other distro makers would look closer at YAST, it's by far the best config etc tool I've seen.
We have our own here in the UK, only we call it a "Carol Vorderman".
funny editorialising?
:p
I think the "xxxx dept" stuff is incredibly stupid. I haven't found any of it funny. It is lame. It could be funny when used sparingly and with intelligence. However, when every submission has that crap and there are also dupes, factual mistakes and typos, it makes me wonder whether the mods (and some of the submitters) are monkeys.
Also, what's the deal with the stupid questions that try to appear intelligent at the end of most submissions?
Is this the end of humanity as we know it!?
...exists due to the way the browser does not handle PNG files. The web would be a beautiful place if content creators could depend on complete PNG support. This problem has been around for over 8 years! IE blows.
That's cool - does anyone else? I'm surprised it's not much more prevalent in non-source based distros, as I know that in at least Debian, every .deb contains a manifest of all files that will be installed by the .deb, and I think a md5 of each one, too. It strikes me that it should be easy to create a "dummy" deb that verifies that the old version has not been tweaked and, if not, simply replaces just the necessary files with fresh copies.
Dell Support Page
Just because you used Firefox doesn't mean you shouldn't update your IE... It's not like the update will harm anything on your PC, so why leave the vulnerabilities open in the first place?
I have to say it was really nice to wake up this morning and have my system ready to reboot after it installed the patches.
Hands off security.
Yummy.
Pretty Pictures!
www.eweek.com is not responding, I can't even read the article...
Is there a mirror somewhere?
I'm using IE7 which has full PNG support amoung other things I'm not talking about.
Our home network is NATed and WinXP SP2 isn't mandatory.
The biggest problem is the occasional spyware infestation. And even that doesn't happen very often anymore. Decent ad-blocking software filters out most of the crud.
I run a virus scan every now and then just to be sure the various programs I've downloaded are clean, but I haven't checked in weeks and honestly I'm not worried.
I'm moving the household over to FireFox (love adblock and greasemonkey) but even with that, I'm the only one who visits shady warez sites.
Viruses are reaching a level of sophistication where most people won't even know they're installed (even if you've got a fancy scanner) because they hook in at the kernel level or use some sneaky pete masking techniques.
Don't believe the hype
[Fuck Beta]
o0t!
Whoever modded this transparent tripe up should be ashamed of themselves.
Obviously not using IE though, it doesn't support transparent tripe.
i have WIn XP Pro at home and never have i had a virus, malware, etc etc, no spur of the moment reboots, no bluescreens. i have cable internet so the computer is on 24/7. i maybe have to reboot once a month for new windows updates but thats about it.
I believe a third party patch is available for that.
http://macuser.pcpro.co.uk/news/72440/tiger-widget -vulnerability-highlighted.html
"Screwts! Screwts! Screwts!"
Don't blame Durga. I voted for Centauri.
I'm expecting this to be exploited by a Blaster/Sasser type worm. Time to go on Terry Tate mode looking for users with laptops...
Yes, my only tool is a hammer. And you're starting to look like a nail.
+1
I agree. Patching windows is far more comfortable than patching linux.
The linux zealots are absurd regarding the PNG issue: buffer overflow in linux libpng was discovered a little while ago - exact same problem. Linux is just as vulnerable to buffer overflows as windows (until all distros use add execshield by default).
The linux zealots need only enter the following in google:
site:http://www.cert.org/advisories/ linux
And they'll get quite a few results.
I use suse, and patching is much easier than with other distros, but still nowhere as comfortable as windows.
Would it kill MS to release patches when the vulnerability is fixed, rather than waiting for some magic 'patch release day'?
"We are all geniuses when we dream"
- E.M. Cioran
Score: 0, Misinformative
theborg is completely mistaken about the meaning of that sentence.
So they moved to a 'once per month' release schedule. A.K.A. 'Black Tuesday' by the same people who just love to bit*ch && moan about any freaking thing Microsoft does -- but I haven't seen of that from the slashdaughters.
Does Tuesday's patchfest include the Several Critical MSIE Flaws Uncovered on May 15? Or has Microsoft finally fixed IE bugs faster than Mozilla fixes Firefox bugs contrary to what I argued last month?
It must be Windows. It needs half a gig of RAM and a hardware-accelerated graphics card just to run Solitaire.
Are we going to do this every month?
It's not like the update will harm anything on your PC
*gasping for air*
Man, I needed that laugh. Thanks!
Dissolve... Resolve... Evolve...
Take the Patch Train to Crashville
And I'll meet you at the station.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
I don't see C/C++ as being the problem. It is more that the security hurdles in Windows makes it impossible to run efficiently in anything but a privilaged account. This allows malware of all sorts to take advantage of vectors not found on other Operating Systems. Opening an email could infect your system if done in a privilaged account. Reading a web page could infect your system if done in a privilaged account. Browsing the local network resources can infect your system... So on and so on.
You'd have to be a zelot fanboy to recognize that any Operating System is a complex software system. Complex software systems are prone to bugs and as pointed out every one of them receive regular updates to patch problems. The problem with Windows is not the bugs but the way they handle them which makes the entire process of correcting flaws painful. Today I've been chasing people to reboot after installing the patches (thankfully I can force the patch install remotely) their system because I know 90% of them won't reboot their machines. I tried once before to reboot in the early mornings but I got an earful from multiple people who didn't save and left things open.
Windows is not only hard to patch in the enterprise, its hard enough to work with that people won't close applicatons! Talk about a double whammy.
"The IE fix corrects a remote code-execution vulnerability that exists due to the way the browser handles PNG (Portable Network Graphics) files."
What the hell does IE do?! Prefixes the picture with an exe-header and runs it?!
The problem is that's pretty hard to defend against those things. Home users don't know how. Corporate network administrators have hundreds of interlocking "business requirements" that prevent them from shutting the door to "critical services" like SMB file sharing between PC systems.
Worms get into corporate networks through a variety of means, borrowing techniques from viruses and mass emailer viruses, as well as adware and spyware. Some of those holes are impossible to block on a typical corporate network. Take the Internet Explorer holes in corporations that have spent the last several years deploying "internet based applications" that only function correctly with Internet Explorer, for example. Can't block 'em. Might take months to patch 'em if you have tens of thousands of PC systems.
Once a worm gets into a network by exploiting a single system through a mundane virus or adware-only hole like this, it's likely to find a wormable exploit on many other systems. Once a worm is inside, the soft candy center of the corporate network is difficult to defend from a worm with conventional techniques, which are typically perimeter defense in nature.
Even worse, some of my clients have reported that they have, out of tens of thousands of users, at least several who seem to get their PC infected over and over and over. They suspect that this is a "coffee break effect". The users learned that if they double-click on the occasional malicious attachment that leaks through the antivirus email filter at the gateway, and the one on their PC, they get the afternoon off because their PC is taken offline by the network admin staff.
So AntiVirus really is part of the layered defense required for "closing those routes" in the modern age for most companies and home users.
By the way, the observed incidents supporting the "coffee break effect" are the worms and viruses that successfully exploit the patch gap or the definition gap. Most of the time that users double-click to unzip, type in the password and then double-click to execute a malicious attachment, they are thwarted by the AntiVirus system.
If you mod me down, I shall become more powerful than you could possibly imagine.
Maybe I've been lucky, but none of the critical updates I've applied have screwed up my system, heh. Neither did this one. ...It's still funny how IE craps the bed when it tries to render a transparent PNG, though (post-update).
This set of patches destroyed the registry for me on a XP SP1 machine. End result was a blue screen just before the login screen appeared. YMMV, but I spent a good part of this evening fixing said machine.