I was just asked about the MS13-022 fixlets and I noticed that the fixlet “1302201 MS13-022: Vulnerability in Silverlight Could Allow Remote Code Execution - Silverlight” has no default action as stated in the notes. The other 3 fixlets also state that there is no default action in the notes, but they all have a default action.
I cannot see anything in the notes that suggests why it should not have a default action. Usually when I see this, I can go to the description in the fixlet to see (ie, Java) or to the known issues on the MS website.
Thanks. That KB article mentions only upgrading from Silverlight 4 to 5, but actually, the patch also applies to even older versions of Silverlight. For any customers that might still be running and depending on really old versions of Silverlight, we wanted them to not just blindly apply everything that was relevant, so we removed the default action.
Good catch on not all of them having the default action in place though. We’ll poke back when it’s republished.