Revised 6/8/2021: On June 8th, 2021, this update was released to replace a previous update to address a “revocation server was offline” error that may occur during installation. If you’ve already installed a previous release of this update, no action is required.

Revised 4/15/2021: On April 13th, 2021, this update was released to replace a previous release of this some updates. See known issues section for more details. If you’ve already installed a previous release of an affected update, no action is required.

Today, we are releasing the July 2020 Security and Quality Rollup Updates for .NET Framework.

Security

CVE-2020-1147– .NET Framework Remote Code Execution Vulnerability

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the process responsible for deserialization of the XML content.

To exploit this vulnerability, an attacker could upload a specially crafted document to a server utilizing an affected product to process content.

The security update addresses the vulnerability by correcting how .NET Framework, Microsoft SharePoint, and Visual Studio validates the source markup of XML content.

Additional Information

This security update affects how .NET Framework’s System.Data.DataTable and System.Data.DataSet types read XML-serialized data. Most .NET Framework applications will not experience any behavioral change after the update is installed. For more information on how the update affects .NET Framework, including examples of scenarios which may be affected, please see the DataTable and DataSet security guidance document.

Known Issue in This Security Update

Getting the Update

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, and Microsoft Update Catalog. The Security Only Update is available via Windows Server Update Services and Microsoft Update Catalog.

Microsoft Update Catalog

You can get the update via the Microsoft Update Catalog. For Windows 10, NET Framework 4.8 updates are available via Windows Update, Windows Server Update Services, Microsoft Update Catalog. Updates for other versions of .NET Framework are part of the Windows 10 Monthly Cumulative Update.

Note: Customers that rely on Windows Update and Windows Server Update Services will automatically receive the .NET Framework version-specific updates. Advanced system administrators can also take use of the below direct Microsoft Update Catalog download links to .NET Framework-specific updates. Before applying these updates, please ensure that you carefully review the .NET Framework version applicability, to ensure that you only install updates on systems where they apply.

The following table is for Windows 10 and Windows Server 2016+ versions.

The following table is for Windows 8.1 and Windows Server 2012 R2 and earlier versions.

Previous Monthly Rollups

The last few .NET Framework Monthly updates are listed below for your convenience:

* May 2020 Security and Quality Rollup Updates * March 2020 Update for Windows 10 1607 (Anniversary Update) and Windows Server 2016 * February 2020 Preview of Quality Rollup for Windows 10 1909, Windows 10 1903, Windows Server, version 1909 and Windows Server, version 1903 * February 2020 Preview of Quality Rollup