Windows 10: .NET Framework February 2020 Security and Quality Rollup

Brink · Feb 13, 2020

Today, we are releasing the February 2020 Security and Quality Rollup Updates for .NET Framework.

Security

The February Security and Quality Rollup Update does not contain any new security fixes. See January 2020 Security and Quality Rollup for the latest security updates.

Quality and Reliability

This release contains the following quality and reliability improvements. Some improvements included in the Security and Quality Rollup and were previously released in the Security and Quality Rollup that was dated January 23, 2020.

Acquistion & Deployment

Addresses an issue where the installation of .NET 4.8 on Windows machines prior to 1809 build prevents .NET-specific settings to be migrated during Windows upgrade to build 1809. Note: to prevent this issue, this update must be applied before the upgrade to a newer version of Windows.

CLR

A change in .NET Framework 4.8 regressed certain EnterpriseServices scenarios where an single-thread apartment object may be treated as an multi-thread apartment and lead to a blocking failure. This change now correctly identifies single-thread apartment objects as such and avoids this failure.

There is a race condition in the portable PDB metadata provider cache that leaked providers and caused crashes in the diagnostic StackTrace API. To fix the race, detect the cause where the provider wasnât being disposed and dispose it.

Addresses an issue when in Server GC, if you are truly out of memory when doing SOH allocations (ie, there has been a full blocking GC and still no space to accommodate your SOH allocation), you will see full blocking GCs getting triggered over and over again with the trigger reason OutOfSpaceSOH. This fix is to throw OOM when we have detected this situation instead of triggering GCs in a loop.

Addresses an issue caused by changing process affinity from 1 to N cores.

Net Libraries

Strengthens UdpClient against incorrect usage in network configurations with an exceptionally large MTU.

SQL

Addresses an issue with SqlClient Bid traces where information wasnât being printed due to incorrectly formatted strings.

WCF

Thereâs a race condition when listening paths are being closed down because of an IIS worker process crash and the same endpoints being reconfigured as listening but pending activation. When a conflict is found, this change allows for retrying with the assumption the conflict was transient due to this race condition. The retry count and wait duration are configurable via app settings.

Added opt-in retry mechanism when configuring listening endpoints on the WCF Activation service to address potential race condition when rapidly restarting an IIS application multiple times while under high CPU load which resulted in an endpoint being inaccessible. Customers can opt in to the fix by adding the following AppSetting to SMSvcHost.exe.config under the %windir%\Microsoft.NET\Framework\v4.0.30319 and %windir%\Microsoft.NET\Framework64\v4.0.30319 folders as appropriate. This will retry registering an endpoint 10 times with a 1 second delay between each attempt before placing the endpoint in a failure state. < add key=âwcf:SMSvcHost:listenerRegistrationRetryDelaymsâ value=â1000″>

Windows Forms

Addresses an issue in System.Windows.Forms.TextBox controls with ImeMode property set to NoControl. These controls now retain IME setting consistent with the OS setting regardles of the order of navigation on the page. Fix applies to CHS with pinyin keyboard.

Addresses an issue with System.Windows.Forms.ComboBox control with ImeMode set to ImeMode.NoControl on CHS with Pinyin keyboard to retain input mode of the parent container control instead of switching to disabled IME when navigating using mouse clicks and when focus moves from a control with disabled IME to this ComboBox control.

An accessibility change in .NET Framework 4.8 regressed editing IP address UI in the DataGridView in Create Cluster Wizard in Failover Cluster Services: users canât enter the IP value after control UIA tree restructuring related to editing control movement to another editing cell. Such custom DataGridView cells (IP address cell) and their inner controls are currently not processed in default UIA tree restructuring to prevent this issue.

WPF

Addresses an issue where under some circumstances, Popupâs in high-DPI WPF applications are not shown, are shown at the top-left corner of the screen, or are shown/rendered incompletely.

Addresses an issue when creating an XPS document in WPF, font subsetting may result in a FileFormatException of the process of subsetting would grow the font.

Addresses incorrect width of the text-insertion caret in TextBox et al., when the system DPI exceeds 96. In particular, the caret rendered nothing on a monitor with lower DPI than the primary, in some DPI-aware situations.

Addresses a hang arising during layout of Grids with columns belonging to a SharedSizeGroup.

Addresses a hang and eventual StackOverflowException arising when opening a RibbonSplitButton, if the app programmatically disables the button and replaces its menu items before the user releases the mouse button.

Addresses certain hangs that can arise while scrolling a TreeView.

1 Common Language Runtime (CLR)
2 Windows Communication Foundation (WCF) 3 Windows Presentation Foundation (WPF)

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, NET Framework 4.8 updates are available via Windows Update, Windows Server Update Services, Microsoft Update Catalog. Updates for other versions of .NET Framework are part of the Windows 10 Monthly Cumulative Update.

Note: Customers that rely on Windows Update and Windows Server Update Services will automatically receive the .NET Framework version-specific updates. Advanced system administrators can also take use of the below direct Microsoft Update Catalog download links to .NET Framework-specific updates. Before applying these updates, please ensure that you carefully review the .NET Framework version applicability, to ensure that you only install updates on systems where they apply.

The following table is for Windows 10 and Windows Server 2016+ versions.

Product Version Cumulative Update Windows 10 1909 and Windows Server, version 1909 .NET Framework 3.5, 4.8 Catalog 4534132 Windows 10 1903 and Windows Server, version 1903 .NET Framework 3.5, 4.8 Catalog 4534132 Windows 10 1809 (October 2018 Update) and Windows Server 2019 4538122 .NET Framework 3.5, 4.7.2 Catalog 4534119 .NET Framework 3.5, 4.8 Catalog 4534131 Windows 10 1803 (April 2018 Update) .NET Framework 3.5, 4.7.2 Catalog 4537762 .NET Framework 4.8 Catalog 4534130 Windows 10 1709 (Fall Creators Update) .NET Framework 3.5, 4.7.1, 4.7.2 Catalog 4537789 .NET Framework 4.8 Catalog 4534129 Windows 10 1703 (Creators Update) .NET Framework 3.5, 4.7, 4.7.1, 4.7.2 Catalog 4537765 .NET Framework 4.8 Catalog 4537557 Windows 10 1607 (Anniversary Update) and Windows Server 2016 .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2 Catalog 4537764 .NET Framework 4.8 Catalog 4534126 Windows 10 1507 .NET Framework 3.5, 4.6, 4.6.1, 4.6.2 Catalog 4537776
The following table is for earlier Windows and Windows Server versions.

Product Version Security and Quality Rollup Windows 8.1, Windows RT 8.1 and Windows Server 2012 R2 4538124 .NET Framework 3.5 Catalog 4532946 .NET Framework 4.5.2 Catalog 4534120 .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 Catalog 4534117 .NET Framework 4.8 Catalog 4534134 Windows Server 2012 4538123 .NET Framework 3.5 Catalog 4532943 .NET Framework 4.5.2 Catalog 4534121 .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 Catalog 4534116 .NET Framework 4.8 Catalog 4534133

Note: Windows 7 support ended on January 14, 2020

Click to expand...

Source: https://devblogs.microsoft.com/dotne...uality-rollup/

:)

Brink · Feb 13, 2020

.NET Framework July 2017 Security and Quality Rollup

Today, we are releasing a new Security and Quality Rollup and Security Only Update for the .NET Framework. Today’s update applies to Windows 10 and Windows Server 2016.

Security
Microsoft Common Vulnerabilities and Exposures CVE-2017-8585

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.

The update addresses the vulnerability by correcting how the .NET web application handles web requests.

More info: Microsoft Common Vulnerabilities and Exposures CVE-2017-0248.

Quality and Reliability
There are no quality and reliability changes this month.

Getting the Update
The Security and Quality Rollup is available via Windows Update, Windows Server Update Services and Microsoft Update Catalog. The Security Only Update is not available for Windows 10. The updates for Windows 10 are integrated with the Windows 10 Monthly Update.

You can learn more about the releases from the table below.

[table][tr]Windows Version .NET Version Rollup KB Security-only KB [/tr] [tr][td]Windows 10 Update 1703 (Creators Update)[/td] [td].NET Framework 3.5 and 4.7[/td] [td]4025342[/td] [td]N/A[/td] [/tr] [tr][td]Windows 10 Update 1607 (Anniversary Update) Windows Server 2016[/td] [td].NET Framework 3.5, 4.6.2 and 4.7[/td] [td]4025339[/td] [td]N/A[/td] [/tr] [tr][td]Windows 10 Update 1511[/td] [td].NET Framework 3.5 and 4.6.1[/td] [td]4025344[/td] [td]N/A[/td] [/tr] [tr][td]Windows 10 Update 1507[/td] [td].NET Framework 3.5 and 4.6[/td] [td]4025338[/td] [td]N/A[/td] [/tr] [/table]

Docker Images
The following Docker images have been updated with today’s release.
You must explicitly re-pull images to update your local Docker image cache, for example with docker pull microsoft/dotnet-framework:4.7. The Docker client does not pull updated base images automatically.

.NET Framework
The .NET Framework Docker images have been updated to include the .NET Framework July Security and Quality Rollup and have been rebased on top of the latest microsoft/windowsservercore base image (released today).

microsoft/dotnet-framework

Note: The update to the microsoft/wcf and microsoft/aspnet images are still pending.

.NET Core
The .NET Core Docker images have been updated to rebase on top of the latest microsoft/nanoserver base image (released today). .NET Core has not been updated.

microsoft/aspnetcore

microsoft/aspnetcore-build

microsoft/dotnet

Previous Monthly Rollups
The last few .NET Framework Monthly updates are listed below for your convenience:

June 2017 Cumulative Quality Update for Windows 10

May 2017 Cumulative Quality Update for Windows 10

May 2017 Security and Quality Rollup

April 2017 Security and Quality Rollup

Previously released security and quality updates are included in today’s release. You can read the .NET Framework Monthly Rollups Explainedto learn more about how the .NET Framework is updated.
Click to expand...

Source: .NET Framework July 2017 Security and Quality Rollup | .NET Blog

Brink · Feb 13, 2020

.NET Framework June 2018 Security and Quality Rollup

Today, we are releasing the June 2018 Security and Quality Rollup.

Security

No new security fixes. See .NET Framework May 2018 Security and Quality Rollup for the latest security updates.

Quality and Reliability

This release contains the following quality and reliability improvements.

CLR

Fix the binary serialization compatibility issue for CultureAwareComparer class [620693]

Note: Additional information on these improvements is not available. The VSTS bug number provided with each improvement is a unique ID that you can give Microsoft Customer Support, include in StackOverflow commentsor use in web searches.

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, .NET Framework updates are part of the Windows 10 Monthly Rollup.

[table][tr]Product Version Security and Quality Rollup KB [/tr] [tr][td]Windows 10 1709 (Fall Creators Update)[/td] [td]Catalog 4284819[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284819[/td] [/tr] [tr][td].NET Framework 4.7.1[/td] [td]4284819[/td] [/tr] [tr][td]Windows 10 1703 (Creators Update)[/td] [td]Catalog 4284874[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284874[/td] [/tr] [tr][td].NET Framework 4.7, 4.7.1[/td] [td]4284874[/td] [/tr] [tr][td]Windows 10 1607 (Anniversary Update) Windows Server 2016[/td] [td]Catalog 4284880[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284880[/td] [/tr] [tr][td].NET Framework 4.6.2, 4.7, 4.7.1[/td] [td]4284880[/td] [/tr] [/table]
Click to expand...

Source: .NET Framework June 2018 Security and Quality Rollup | .NET Blog

Brink · Feb 13, 2020

.NET Framework June 2018 Security and Quality Rollup

Today, we are releasing the June 2018 Security and Quality Rollup.

Security

No new security fixes. See .NET Framework May 2018 Security and Quality Rollup for the latest security updates.

Quality and Reliability

This release contains the following quality and reliability improvements.

CLR

Fix the binary serialization compatibility issue for CultureAwareComparer class [620693]

Note: Additional information on these improvements is not available. The VSTS bug number provided with each improvement is a unique ID that you can give Microsoft Customer Support, include in StackOverflow commentsor use in web searches.

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, .NET Framework updates are part of the Windows 10 Monthly Rollup.

[table][tr]Product Version Security and Quality Rollup KB [/tr] [tr][td]Windows 10 1709 (Fall Creators Update)[/td] [td]Catalog 4284819[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284819[/td] [/tr] [tr][td].NET Framework 4.7.1[/td] [td]4284819[/td] [/tr] [tr][td]Windows 10 1703 (Creators Update)[/td] [td]Catalog 4284874[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284874[/td] [/tr] [tr][td].NET Framework 4.7, 4.7.1[/td] [td]4284874[/td] [/tr] [tr][td]Windows 10 1607 (Anniversary Update) Windows Server 2016[/td] [td]Catalog 4284880[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284880[/td] [/tr] [tr][td].NET Framework 4.6.2, 4.7, 4.7.1[/td] [td]4284880[/td] [/tr] [/table]
Click to expand...

Source: .NET Framework June 2018 Security and Quality Rollup | .NET Blog

Windows 10: .NET Framework February 2020 Security and Quality Rollup

.NET Framework February 2020 Security and Quality Rollup

.NET Framework February 2020 Security and Quality Rollup

.NET Framework February 2020 Security and Quality Rollup

.NET Framework February 2020 Security and Quality Rollup - Similar Threads - NET Framework February

.NET Framework February 2019 Preview of Quality Rollup

.NET Framework November 2018 Security and Quality Rollup

.NET Framework October 2018 Security and Quality Rollup

.NET Framework September 2018 Security and Quality Rollup

.NET Framework June 2018 Security and Quality Rollup

.NET Framework July 2017 Security and Quality Rollup

.NET Framework January 2018 Security and Quality Rollup

.NET Framework October 2017 Security and Quality Rollup

.NET Framework September 2017 Security and Quality Rollup