As you may know, Office 2003 Service Pack 3 contains some changes to the behaviour of Office. For example, certain file types cannot be opened or saved by default, although you can re-enable this functionality by setting registry keys as described in this Microsoft Knowledge Base article and on David LeBlanc’s Blog. A common question is whether these behaviour changes are included in post-SP3 security updates. In short, yes: post-SP3 security updates contain behaviour changes first released in SP3. This post will briefly describe why that occurs and will outline which updates contain which changes.
For several reasons, Office patches are cumulative - broadly speaking, they contain all changes from previous updates to the same component, including service packs. By “component”, we mean the set of files in the patch - typically, this is the file or set of files like excel.exe that define the core, central functionality of an application. We plan to provide a more thorough explanation in a future post. The key thing to know for this discussion is that the latest update to Excel will contain SP3 changes in Excel, including behaviour changes, and likewise for the other Office applications. This occurs even if SP3 has not been installed. The information in this post applies to all update types, including security updates, non-security updates, and hot fixes.