{"id":14485,"date":"2017-09-12T18:11:33","date_gmt":"2017-09-13T01:11:33","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/dotnet\/?p=14485"},"modified":"2021-09-29T16:40:03","modified_gmt":"2021-09-29T23:40:03","slug":"net-framework-september-2017-security-and-quality-rollup","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/net-framework-september-2017-security-and-quality-rollup\/","title":{"rendered":".NET Framework September 2017 Security and Quality Rollup"},"content":{"rendered":"

Last Updated: <\/strong>2017.09.21.<\/p>\n

Today, we are releasing the September 2017 Security and Quality Rollup and Security Only Update.<\/p>\n

This update applies to Windows 7 and later client versions and Windows Server 2008 and later server versions.<\/p>\n

This update has known issues. Please see them at the bottom of the update.<\/em><\/p>\n

<\/a>Security<\/h2>\n

This release contains the following security changes.<\/p>\n

<\/a>CVE-2017-8759 | .NET Framework Remote Code Execution Vulnerability<\/h4>\n

A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input. An attacker who successfully exploited this vulnerability in software using the .NET framework could take control of an affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.<\/p>\n

To exploit the vulnerability, an attacker would first need to convince the user to open a malicious document or application.\nThe security update addresses the vulnerability by correcting how .NET validates untrusted input.<\/p>\n

More Information: CVE-2017-8759<\/a><\/p>\n

<\/a>Quality and Reliability<\/h2>\n

This release contains the following quality and reliability improvements.<\/p>\n

<\/a>ASP.NET<\/h4>\n