Windows 10: .NET Framework September 2018 Security and Quality Rollup

Brink · Sep 11, 2018

Today, we are releasing the September 2018 Security and Quality Rollup.

Security

CVE-2018-8421 – Windows Remote Code Execution Vulnerability

This security update resolves a vulnerability in Microsoft .NET Framework that could allow remote code execution when .NET Framework processes untrusted input. An attacker who successfully exploits this vulnerability in software by using .NET Framework could take control of an affected system. The attacker could then install programs; view, change, or delete data; or create new accounts that have full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

To exploit the vulnerability, an attacker would first have to convince the user to open a malicious document or application.

This security update addresses the vulnerability by correcting how .NET Framework validates untrusted input.

CVE-2018-8421

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, Microsoft Update Catalog, and Docker.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, .NET Framework updates are part of the Windows 10 Monthly Rollup.

The following table is for Windows 10 and Windows Server 2016+.

Product Version Security and Quality Rollup KB Windows 10 1803 (April 2018 Update) Catalog
4457128 .NET Framework 3.5 4457128 .NET Framework 4.7.2 4457128 Windows 10 1709 (Fall Creators Update) Catalog
4457142 .NET Framework 3.5 4457142 .NET Framework 4.7.1, 4.7.2 4457142 Windows 10 1703 (Creators Update) Catalog
4457138 .NET Framework 3.5 4457138 .NET Framework 4.7, 4.7.1, 4.7.2 4457138 Windows 10 1607 (Anniversary Update)
Windows Server 2016 Catalog
4457131 .NET Framework 3.5 4457131 .NET Framework 4.6.2, 4.7, 4.7.1, 4.7.2 4457131 Windows 10 1507 Catalog
4457132 .NET Framework 3.5 4457132 .NET Framework 4.6, 4.6.1, 4.6.2 4457132
The following table is for earlier Windows and Windows Server versions.

Product Version Security and Quality Rollup KB Security Only Update KB Windows 8.1
Windows RT 8.1
Windows Server 2012 R2 Catalog
4457920 Catalog
4457916 .NET Framework 3.5 4457045 4457056 .NET Framework 4.5.2 4457036 4457028 .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 4457034 4457026 Windows Server 2012 Catalog
4457919 Catalog
4457915 .NET Framework 3.5 4457042 4457053 .NET Framework 4.5.2 4457037 4457029 .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 4457033 4457025 Windows 7
Windows Server 2008 R2 Catalog
4457918 Catalog
4457914 .NET Framework 3.5.1 4457044 4457055 .NET Framework 4.5.2 4457038 4457030 .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 4457035 4457027 Windows Server 2008 Catalog
4457921 Catalog
4457917 .NET Framework 2.0, 3.0 4457043 4457054 .NET Framework 4.5.2 4457038 4457030 .NET Framework 4.6 4457035 4457027
Docker Images

We are updating the following .NET Framework Docker images for today’s release:

microsoft/aspnet

microsoft/dotnet-framework

microsoft/dotnet-framework-samples

Note: Look at the “Tags” view in each repository to see the updated Docker image tags.
Click to expand...

Source: .NET Framework September 2018 Security and Quality Rollup | .NET Blog

:)

Brink · Sep 12, 2018

.NET Framework June 2018 Security and Quality Rollup

Today, we are releasing the June 2018 Security and Quality Rollup.

Security

No new security fixes. See .NET Framework May 2018 Security and Quality Rollup for the latest security updates.

Quality and Reliability

This release contains the following quality and reliability improvements.

CLR

Fix the binary serialization compatibility issue for CultureAwareComparer class [620693]

Note: Additional information on these improvements is not available. The VSTS bug number provided with each improvement is a unique ID that you can give Microsoft Customer Support, include in StackOverflow commentsor use in web searches.

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, .NET Framework updates are part of the Windows 10 Monthly Rollup.

[table][tr]Product Version Security and Quality Rollup KB [/tr] [tr][td]Windows 10 1709 (Fall Creators Update)[/td] [td]Catalog 4284819[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284819[/td] [/tr] [tr][td].NET Framework 4.7.1[/td] [td]4284819[/td] [/tr] [tr][td]Windows 10 1703 (Creators Update)[/td] [td]Catalog 4284874[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284874[/td] [/tr] [tr][td].NET Framework 4.7, 4.7.1[/td] [td]4284874[/td] [/tr] [tr][td]Windows 10 1607 (Anniversary Update) Windows Server 2016[/td] [td]Catalog 4284880[/td] [/tr] [tr][td].NET Framework 3.5[/td] [td]4284880[/td] [/tr] [tr][td].NET Framework 4.6.2, 4.7, 4.7.1[/td] [td]4284880[/td] [/tr] [/table]
Click to expand...

Source: .NET Framework June 2018 Security and Quality Rollup | .NET Blog

Brink · Sep 12, 2018

.NET Framework September 2017 Preview of Quality Rollup

Today, we are releasing the September 2017 Preview of Quality Rollup. This type of rollup is intended for businesses that want to the preview or use quality improvements as soon as they are available.

This update applies to Windows 10 Update 1607 (Anniversary Update) and to Windows Server 2016.

FYI: The KBs for Windows Server 2016 have been delayed but will be available soon. This post will be updated when Windows Server 2016 KBs are available.

Quality and Reliability

This release contains the following quality and reliability improvements.

CLR

Silent bad codegen when optimizing expression. [460765]

Also reported at dotnet/coreclr #11574

Crash in Visual Studio due to race in CLR assembly loader. [462762]

Runtime underallocates arrays by one element in rare cases when jitting large methods. [463604]

AppContext feature opt-in/out not functioning correctly. [469020]

More information: .NET Framework Update for AppContext

Networking

HTTPWebRequest times out when switching to TLS after installing update KB4019112. [465796]

Windows Forms

Multi-Mon support: Controls with non-default anchoring are moved around the screen when scaling is changed [462872].

WPF

WPF consumes high % of CPU in Visual Studio when console session not active. [391184]

Application crash due to call into DWrite. [453529]

Note: Additional information on these improvements is not available. The VSTS bug number provided with each improvement is a unique ID that you can give Microsoft Customer Support, include in StackOverflow commentsor use in web searches.

Getting the Update

The Preview of Quality Rollup is available via Windows Update, Windows Server Update Services and Microsoft Update Catalog.

Downloading KBs from Microsoft Update Catalog

You can download patches from the table below. See .NET Framework Monthly Rollups Explained for an explanation on how to use this table to download patches from Microsoft Update Catalog.

[table][tr]Product Version Preview of Quality Rollup KB [/tr] [tr][td]Windows 10 Update 1607 Windows Server 2016[/td] [td]Catalog 4038801[/td] [/tr] [tr][td].NET Framework 4.6.2 and 4.7[/td] [td]4038801[/td] [/tr] [/table]
Click to expand...

Source: .NET Framework September 2017 Preview of Quality Rollup | .NET Blog

Brink · Sep 12, 2018

.NET Framework July 2017 Security and Quality Rollup

Today, we are releasing a new Security and Quality Rollup and Security Only Update for the .NET Framework. Today’s update applies to Windows 10 and Windows Server 2016.

Security
Microsoft Common Vulnerabilities and Exposures CVE-2017-8585

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.

A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.

The update addresses the vulnerability by correcting how the .NET web application handles web requests.

More info: Microsoft Common Vulnerabilities and Exposures CVE-2017-0248.

Quality and Reliability
There are no quality and reliability changes this month.

Getting the Update
The Security and Quality Rollup is available via Windows Update, Windows Server Update Services and Microsoft Update Catalog. The Security Only Update is not available for Windows 10. The updates for Windows 10 are integrated with the Windows 10 Monthly Update.

You can learn more about the releases from the table below.

[table][tr]Windows Version .NET Version Rollup KB Security-only KB [/tr] [tr][td]Windows 10 Update 1703 (Creators Update)[/td] [td].NET Framework 3.5 and 4.7[/td] [td]4025342[/td] [td]N/A[/td] [/tr] [tr][td]Windows 10 Update 1607 (Anniversary Update) Windows Server 2016[/td] [td].NET Framework 3.5, 4.6.2 and 4.7[/td] [td]4025339[/td] [td]N/A[/td] [/tr] [tr][td]Windows 10 Update 1511[/td] [td].NET Framework 3.5 and 4.6.1[/td] [td]4025344[/td] [td]N/A[/td] [/tr] [tr][td]Windows 10 Update 1507[/td] [td].NET Framework 3.5 and 4.6[/td] [td]4025338[/td] [td]N/A[/td] [/tr] [/table]

Docker Images
The following Docker images have been updated with today’s release.
You must explicitly re-pull images to update your local Docker image cache, for example with docker pull microsoft/dotnet-framework:4.7. The Docker client does not pull updated base images automatically.

.NET Framework
The .NET Framework Docker images have been updated to include the .NET Framework July Security and Quality Rollup and have been rebased on top of the latest microsoft/windowsservercore base image (released today).

microsoft/dotnet-framework

Note: The update to the microsoft/wcf and microsoft/aspnet images are still pending.

.NET Core
The .NET Core Docker images have been updated to rebase on top of the latest microsoft/nanoserver base image (released today). .NET Core has not been updated.

microsoft/aspnetcore

microsoft/aspnetcore-build

microsoft/dotnet

Previous Monthly Rollups
The last few .NET Framework Monthly updates are listed below for your convenience:

June 2017 Cumulative Quality Update for Windows 10

May 2017 Cumulative Quality Update for Windows 10

May 2017 Security and Quality Rollup

April 2017 Security and Quality Rollup

Previously released security and quality updates are included in today’s release. You can read the .NET Framework Monthly Rollups Explainedto learn more about how the .NET Framework is updated.
Click to expand...

Source: .NET Framework July 2017 Security and Quality Rollup | .NET Blog

Windows 10: .NET Framework September 2018 Security and Quality Rollup

.NET Framework September 2018 Security and Quality Rollup

.NET Framework September 2018 Security and Quality Rollup

.NET Framework September 2018 Security and Quality Rollup

.NET Framework September 2018 Security and Quality Rollup - Similar Threads - NET Framework September

.NET Framework December 2018 Security and Quality Rollup

.NET Framework November 2018 Preview of Quality Rollup

.NET Framework November 2018 Security and Quality Rollup

.NET Framework October 2018 Preview of Quality Rollup

.NET Framework October 2018 Security and Quality Rollup

.NET Framework June 2018 Security and Quality Rollup

.NET Framework January 2018 Security and Quality Rollup

.NET Framework September 2017 Preview of Quality Rollup

.NET Framework September 2017 Security and Quality Rollup

Users found this page by searching for:

Security and Quality Rollup for .NET Framework 4.5.2 sep 2018 error

KB4457027

download KB 4457914