Botched Updates KB4025252 and KB4025336 (July 2017)

Microsoft has released on July 11, 2017 two botched updates KB4025252 and KB4025336 for Internet Explorer and Windows 8.1. Here's what's wrong with these updates. Addendum: It seems that an update revision fixed some install issues.

The IE patch desaster

User how installed June security updates KB4021558 or KB4022719 or KB4022725 etc. run into printing issues in Internet Explorer 11. I mentioned it within my blog post June 2017 Patches causing Internet Explorer 11 printing issues.

Microsoft issued Update KB4032782 to fix this error (see IE11 printing issues in Windows are fixed (June 2017)). But users are reporting crashes of Internet Explorer 11 during visiting several web sites.

A fix for Internet Explorer 11 crashes (July 2017)

On July 11, 2017 Microsoft released another fix for Internet Explorer that shall fix the crashes during visiting complex web sites.

• In Windows 7 SP1 (and corresponding Server variants) Rollup Update KB4025341 fixes the crashing issue.
• In Windows 8.1 (and corresponding Server variants) Rollup Update KB4025336 fixes the crashing issue
• For Windows 10 and Windows Server 2017 cumulative updates KB4025342, KB4025339, KB4025344, and KB4025338 contains the fix.

I've mentioned these updates within my blog post Microsoft July 2017 patch day.

Update KB4025252 reinstalling multiple time

Microsoft has also released cumulative update KB4025252 for Internet Explorer. This update is helpful for admins installing security-only Rollup updates for Windows 7 SP1 or Windows 8.1 and the corresponding Server variants. But it seems that this patch is botched, many users are reporting issues (at least with WSUS).

• I received the first information as a comment within my German blog. Users reporting, that update KB4025252 is offered multiple times for installing in WSUS.
• Also this comment within my Englisch blog mentions the update loop for this package.
• At reddit.com a user created this thread reporting the same issue.
• And within this technet forum thread, many users are confirming, that update KB4025252 is offered multiple times for installing in WSUS or via SCCM.

German blog reader Marco R. informed me via e-mail, that update KB4025252 is offered also several times via SCCM. While SCCM says, the update install fails …

(Click to resize)

… the Windows event manager says, the update is installed successful.

(Click to resize)

The only workaround: Hide or block this update in WSUS or SCCM and wait, until Microsoft delivers the next fix.

Revised update KB4025252 fixes WSUS issue

Some German blog readers mentioned Microsoft has released revision 210 of update KB4025252 on July 12, 2017 for WSUS and SCCM. Further comments posted within my German blog are saying, that multiple installs an clients via WSUS has been fixed.

But Microsoft hasn't updated the KB article yet.

I also contacted blog reader Marco R., wo has send me the SCCM screenshots above. He wrote back that the revised update is offered on SCCM, bit there are still install errrors (see screenshot below).

(Click to resize)

Macro tries to verify it again, but till yet it seems that it hasn't been fixed for SCCM.

Update KB4025336 blocks WSUS connections in clients

German blog reader JohnRipper points within this comment to another issue. Update KB4025336 (Monthly Rollup für Windows 8.1/Windows Server 2012 R2) blocks the clients connection to WSUS. The clients reporting error 0x80244008 during update search. This error code stands for (see Windows: How to decode update 0x8024…. errors):

WU_E_PT_SOAPCLIENT_PARSEFAULT – 0x80244008 – (16392) – Same as SOAPCLIENT_PARSEFAULT_ERROR – SOAP client failed to parse a SOAP fault.

Also in Technet forum this thread discussing the same issue. If you wondering about KB4022720 mentioned within this thread: It's the Preview of the Monthly Rollups. In other words: Microsoft was aware about this issue since end of June 2017, but they decided to ship the botched update on July 11, 2017.