.NET Framework July 2020 Security and Quality Rollup Updates

Tara Overfield

Tara

On July 23, 2020, updates KB4565616 v2, KB4565623 v2, KB4565636 v2, KB4565583 v2, KB4565586 v2 and KB4565589 v2 were released to replace v1 of those updates for .NET Framework 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, and 4.8 for Windows 7 Service Pack 1 (SP1), Windows Server 2008 R2 SP1 and Windows Server 2008 Service Pack 2 (SP2). The v1 updates did not install for customers who had certain ESU configurations. The v2 updates correct the issue for customers who could not install the v1 updates.

If you have already installed v1 of these updates, no action is necessary.

To obtain v2 of these updates, see the “How to obtain and install the update” section of the individual update article. Links to each article are found in the “Additional information about this update section” of the KB article.


Today, we are releasing the July 2020 Security and Quality Rollup Updates for .NET Framework.

Security

CVE-2020-1147– .NET Framework Remote Code Execution Vulnerability

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content.

To exploit this vulnerability, an attacker could upload a specially crafted document to a server utilizing an affected product to process content.

The security update addresses the vulnerability by correcting how .NET Framework, Microsoft SharePoint, and Visual Studio validates the source markup of XML content.

Additional Information

This security update affects how .NET Framework’s System.Data.DataTable and System.Data.DataSet types read XML-serialized data. Most .NET Framework applications will not experience any behavioral change after the update is installed. For more information on how the update affects .NET Framework, including examples of scenarios which may be affected, please see the DataTable and DataSet security guidance document.

Known Issue

You may observe a patch install failure with Error: 0x643, or error code 1603, when attempting to install this update on a system with a proper Extended Security Update (ESU) license installed.

We are working on a resolution and will provide an update in an upcoming release.

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog. The Security Only Update is available via Windows Server Update Services and Microsoft Update Catalog.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, NET Framework 4.8 updates are available via Windows Update, Windows Server Update Services, Microsoft Update Catalog. Updates for other versions of .NET Framework are part of the Windows 10 Monthly Cumulative Update.

Note: Customers that rely on Windows Update and Windows Server Update Services will automatically receive the .NET Framework version-specific updates. Advanced system administrators can also take use of the below direct Microsoft Update Catalog download links to .NET Framework-specific updates. Before applying these updates, please ensure that you carefully review the .NET Framework version applicability, to ensure that you only install updates on systems where they apply.

The following table is for Windows 10 and Windows Server 2016+ versions.

Product VersionCumulative Update
Windows 10 2004 and Windows Server, version 2004
.NET Framework 3.5, 4.8Catalog4565627
Windows 10 1909 and Windows Server, version 1909
.NET Framework 3.5, 4.8Catalog4565633
Windows 10 1903 and Windows Server, version 1903
.NET Framework 3.5, 4.8Catalog4565633
Windows 10 1809 (October 2018 Update) and Windows Server 20194566516
.NET Framework 3.5, 4.7.2Catalog4565625
.NET Framework 3.5, 4.8Catalog4565632
Windows 10 1803 (April 2018 Update)
.NET Framework 3.5, 4.7.2Catalog4565489
.NET Framework 4.8Catalog4565631
Windows 10 1709 (Fall Creators Update)
.NET Framework 3.5, 4.7.1, 4.7.2Catalog4565508
.NET Framework 4.8Catalog4565630
Windows 10 1703 (Creators Update)
.NET Framework 3.5, 4.7, 4.7.1, 4.7.2Catalog4565499
.NET Framework 4.8Catalog4565629
Windows 10 1607 (Anniversary Update) and Windows Server 2016
.NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2Catalog4565511
.NET Framework 4.8Catalog4565628
Windows 10 1507
.NET Framework 3.5, 4.6, 4.6.1, 4.6.2Catalog4565513

The following table is for Windows 8.1 and Windows Server 2012 R2 and earlier versions.

Product VersionSecurity and Quality RollupSecurity Only Update
Windows 8.1, Windows RT 8.1 and Windows Server 2012 R245665194566468
.NET Framework 3.5Catalog4565613Catalog4565580
.NET Framework 4.5.2Catalog4565614Catalog4565581
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2Catalog4565622Catalog4565585
.NET Framework 4.8Catalog4565635Catalog4565588
Windows Server 201245665184566467
.NET Framework 3.5Catalog4565610Catalog4565577
.NET Framework 4.5.2Catalog4565615Catalog4565582
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2Catalog4565621Catalog4565584
.NET Framework 4.8Catalog4565634Catalog4565587
Windows 7 SP1 and Windows Server 2008 R2 SP145665174566466
.NET Framework 3.5.1Catalog4565612Catalog4565579
.NET Framework 4.5.2Catalog4565616Catalog4565583
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2Catalog4565623Catalog4565586
.NET Framework 4.8Catalog4565636Catalog4565589
Windows Server 200845665204566469
.NET Framework 2.0, 3.0Catalog4565611Catalog4565578
.NET Framework 4.5.2Catalog4565616Catalog4565583
.NET Framework 4.6Catalog4565623Catalog4565586

 

Previous Monthly Rollups

The last few .NET Framework Monthly updates are listed below for your convenience:

* May 2020 Security and Quality Rollup Updates * March 2020 Update for Windows 10 1607 (Anniversary Update) and Windows Server 2016 * February 2020 Preview of Quality Rollup for Windows 10 1909, Windows 10 1903, Windows Server, version 1909 and Windows Server, version 1903 * February 2020 Preview of Quality Rollup

0 comments

Comments are closed. Login to edit/delete your existing comments