It’s time again for the monthly drop of security updates for Windows and Office. Here’s what caught our eye; two Excel security bugs and a Windows update which kills VMWare Workstation.
Commentators are calling this a ‘light’ month for security patches because there are a mere 59 patches instead of the usual 80 or more. There are no urgent ‘zero-day’ fixes this month.
Excel bug fixes
Excel gets two patches for different “Remote Code Execution Vulnerabilities”. Both take advantage of ways to trick Excel into running another program in memory without you realizing it.
All it takes is a ‘specially crafted’ Excel workbook. As usual, Microsoft doesn’t say if this applies to the newer .xlsx documents or just the older .xls files. Customers have to assume that both types are possible virus carriers.
There are patches for all supported Excel, from Excel 365 and Excel 2019 back through 2016 and 2013 to Excel 2010. Excel for Mac (365, 2019 and 2016) are also affected.
The Microsoft info pages with download links:
CVE-2019-1331 Microsoft Excel Remote Code Execution Vulnerability
CVE-2019-1327 Microsoft Excel Remote Code Execution Vulnerability
Use the standard update method to install these updates.
VMWare Workstation
Many Microsoft Office users have VMWare Workstation to manage virtual machines with past versions of Office or test code/add-ins. It’s an alternative to Hyper/V which comes with higher end versions of Windows 10.
We explain using Office in virtual machines in a dedicated chapter of Windows 10 for Microsoft Office users.
VMWare Workstation v14 and before now don’t work with Windows 10 getting the error “”VMware Workstation Pro can’t run on Windows”.
The culprit is a Windows patch KB4517211 which lists many fixes but is an incomplete list. The KB article it doesn’t mention that VMWare Workstation has been added to the Windows Compatibility block list.
Upgrading to Workstation v15 is an option, but an expensive one for some organizations.
Some customers need to stay with earlier versions of VMWare Workstation for compatibility with certain types of hardware.
The workarounds are:
- If the computer hasn’t updated yet, pause Windows 10 updates, that will work for a little while.
- Uninstall Cumulative Update KB4517211, if possible. But that also removes all the other fixes in the same update.
- Replace the Windows Compatibility list with a previous version which doesn’t block VMWare. That means replacing C:\Windows\apppatch\sysmain.sdb see this forum for full details.
While that last suggestion is a nasty kludge, it does work. Many annoyed users report replacing sysmain.sdb and VMWare Workstation works perfectly fine on Windows 10.
Which raises several questions … why did Microsoft add Workstation to the incompatibility list at all? And why didn’t Redmond disclose the new block in the update documentation?
