{"id":16566,"date":"2018-01-09T22:39:31","date_gmt":"2018-01-10T06:39:31","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/dotnet\/?p=16566"},"modified":"2021-09-29T16:36:04","modified_gmt":"2021-09-29T23:36:04","slug":"net-framework-january-2018-security-and-quality-rollup","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/net-framework-january-2018-security-and-quality-rollup\/","title":{"rendered":".NET Framework January 2018 Security and Quality Rollup"},"content":{"rendered":"

Updated: January 25, 2018<\/p>\n

Today, we are releasing the January 2018 Security and Quality Rollup.<\/p>\n

An issue with the January 2018 Monthly Rollup was found on Windows 7 and Windows Server 2008 R2 if .NET Framework 4.7.1 was already installed. It has been resolved. The download links for these Windows versions have been updated in the table below. A fixit tool has also be released to fix affected machines. See\u00a0.NET Framework January 2018 Rollup Known Issue KB4074906 – “TypeInitializationException” or “FileFormatException” error in WPF applications<\/a> for more information.<\/span><\/p>\n

See\u00a0.NET Framework 4.7.1 is available on Windows Update, WSUS and MU Catalog!<\/a> for separately available reliability updates for the .NET Framework 4.7.1.<\/p>\n

<\/a>Security<\/h2>\n

<\/a>CVE-2018-0786 \u2013 Security Feature Bypass in X509 Certificate Validation<\/h3>\n

CVE-2018-0786<\/a> – A security feature bypass vulnerability exists when Microsoft .NET Framework (and .NET Core) components do not completely validate certificates.<\/p>\n

An attacker could present a certificate that is marked invalid for a specific use, but the component uses it for that purpose. This action disregards the Enhanced Key Usage taggings.<\/p>\n

The security update addresses the vulnerability by helping to ensure that .NET Framework (and .NET Core) components completely validate certificates.<\/p>\n

<\/a>CVE-2018-0764 \u2013 Denial of Service when parsing XML documents<\/h3>\n

CVE-2018-0764<\/a> – A Denial of Service vulnerability exists when .NET Framework, and .NET core, improperly process XML documents. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to a .NET(or .NET core) application.<\/p>\n

The update addresses the vulnerability by correcting how a .NET, and .NET core, applications handles XML document processing.<\/p>\n

<\/a>Quality and Reliability<\/h2>\n

This release contains no new quality and reliability improvements.<\/p>\n

<\/a>Getting the Update<\/h2>\n

The Security and Quality Rollup is available via Windows Update, Windows Server Update Services, Microsoft Update Catalog, and Docker.<\/p>\n

<\/a>Microsoft Update Catalog<\/h3>\n

You can get the update via the Microsoft Update Catalog. For Windows 10, .NET Framework updates are part of the Windows 10 Monthly Rollup.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Product Version<\/th>\nSecurity and Quality Rollup KB<\/th>\nSecurity-only Update KB<\/th>\n<\/tr>\n<\/thead>\n
Windows 10 1709 (Fall Creators Update)<\/strong><\/td>\nCatalog<\/a>\n4056892<\/a><\/strong><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\n4056892<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.7.1<\/td>\n4056892<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
Windows 10 1703 (Creators Update)<\/strong><\/td>\nCatalog<\/a>\n4056891<\/a><\/strong><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\n4056891<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.7, 4.7.1<\/td>\n4056891<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
Windows 10 1607 (Anniversary Update)<\/strong><\/td>\nCatalog<\/a>\n4056890<\/a><\/strong><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\n4056890<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.6.2, 4.7<\/td>\n4056890<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
Windows 10 1511<\/strong><\/td>\nCatalog<\/a>\n4056888<\/a><\/strong><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\n4056888<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.6.1, 4.6.2<\/td>\n4056888<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
Windows 10 1507<\/strong><\/td>\nCatalog<\/a>\n4056893<\/a><\/strong><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\n4056893<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.6, 4.6.1, 4.6.2<\/td>\n4056893<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
Windows 8.1\nWindows RT 8.1\nWindows Server 2012 R2<\/strong><\/td>\nCatalog<\/a>\n4055266<\/a><\/strong><\/td>\nCatalog<\/a>\n4055271<\/a><\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\n4054999<\/a><\/td>\n4054177<\/a><\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\n4054993<\/a><\/td>\n4054170<\/a><\/td>\n<\/tr>\n
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1<\/td>\n4055001<\/a><\/td>\n4054182<\/a><\/td>\n<\/tr>\n
Windows Server 2012<\/strong><\/td>\nCatalog<\/a>\n4055265<\/a><\/strong><\/td>\nCatalog<\/a>\n4055270<\/a><\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\n4054997<\/a><\/td>\n4054175<\/a><\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\n4054994<\/a><\/td>\n4054171<\/a><\/td>\n<\/tr>\n
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1<\/td>\n4055000<\/a><\/td>\n4054181<\/a><\/td>\n<\/tr>\n
Windows 7\nWindows Server 2008 R2<\/strong><\/td>\nCatalog<\/a>\n4055532<\/a><\/strong><\/td>\nCatalog<\/a>\n4055269<\/a><\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5.1<\/td>\n4054998<\/a><\/td>\n4054176<\/a><\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\n4054995<\/a><\/td>\n4054172<\/a><\/td>\n<\/tr>\n
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1<\/td>\n4074880<\/a><\/td>\n4054183<\/a><\/td>\n<\/tr>\n
Windows Server 2008<\/strong><\/td>\nCatalog<\/a>\n4055267<\/a><\/strong><\/td>\nCatalog<\/a>\n4055272<\/a><\/strong><\/td>\n<\/tr>\n
.NET Framework 2.0, 3.0<\/td>\n4054996<\/a><\/td>\n4054174<\/a><\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\n4054995<\/a><\/td>\n4054172<\/a><\/td>\n<\/tr>\n
.NET Framework 4.6<\/td>\n4055002<\/a><\/td>\n4054183<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Known Issue<\/h3>\n

An issue has been found in the\u00a0<\/span>.NET Framework January 2018 Security and Quality Rollup (KB 4055002)<\/a>, applicable to .NET Framework 4.7.1 installed on either Windows 7 and Windows Server 2008 R2. The .NET team has fixed the issue and re-released the January 2018 Monthly Rollup as\u00a0<\/span>KB 4074880<\/a>.<\/span><\/p>\n

See\u00a0.NET Framework January 2018 Rollup Known Issue KB4074906 – “TypeInitializationException” or “FileFormatException” error in WPF applications<\/a> for more information.<\/p>\n

<\/a>Docker Images<\/h3>\n

Docker images have been updated as part of today’s release (actually, a few days ago).<\/p>\n