The funny thing about DLL hell, is that we've gone almost full circle in many ways.
The shared attitude ment the whole re-install thing, but ment that updates where often applied, the downside was that often broke things.
So then we went for everyone having anything in the same folder, so it was found via the Path (and don't get me started on 'path' thank christ they deprecated it for .Net with fusion).
And then we had Side by Side....... One of the most confusing things ever, "but i've got my crt libs installed". Absolutely horrific.
So how do you apply important security updates to common libs without breaking the app.....
Its really not an easy thing to solve. The only real one in my mind is to do each application from the entry point (trunk) down to the leafs controlled by the trunk. If the trunk hasn't been tested with a security update, it doesn't use the new libs, if the OS polecy dosen't permit running it, it doesn't run as a result.
Things like .Net where each 'Type' that is to say one of the many code components in a dll are known by the full name (version, build, cyrpto) rather than the filesystem name. This actually allows for half of an App to be on one version of a common lib, compared to the other.....
In short, this is fudging confusing, and I don't think there is a perfect solution EXCEPT full package management, which windows is really missing.
The question is how do you do it so its not monopolistic, well thats another thread