{"id":24461,"date":"2019-09-10T11:54:39","date_gmt":"2019-09-10T18:54:39","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/dotnet\/?p=24461"},"modified":"2019-09-10T11:54:39","modified_gmt":"2019-09-10T18:54:39","slug":"net-framework-september-2019-security-and-quality-rollup","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/net-framework-september-2019-security-and-quality-rollup\/","title":{"rendered":".NET Framework September 2019 Security and Quality Rollup"},"content":{"rendered":"

Today, we are releasing the September 2019 Cumulative Update, Security and Quality Rollup, and Security Only Update for .NET Framework.<\/p>\n

<\/a>Security<\/h2>\n

<\/a>CVE-2019-1142\u2013 .NET Framework Elevation of Privilege Vulnerability<\/h3>\n

An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations. An attacker who successfully exploited this vulnerability could write files to folders that require higher privileges than what the attacker already has.<\/p>\n

To exploit the vulnerability, an attacker would need to log into a system. The attacker could then specify the targeted folder and trigger an affected process to run.<\/p>\n

This update addresses the vulnerability correcting how the .NET Framework CLR process logs data.<\/p>\n

CVE-2019-1142<\/a><\/p>\n

 <\/p>\n

<\/a>Getting the Update<\/h2>\n

The Cumulative Update and Security and Quality Rollup are available via Windows Update, Windows Server Update Services, Microsoft Update Catalog, and Docker.\u00a0 The Security Only Update is available via\u00a0Windows Server Update Services and Microsoft Update Catalog.<\/p>\n

 <\/p>\n

<\/a>Microsoft Update Catalog<\/h3>\n

You can get the update via the Microsoft Update Catalog. For Windows 10, NET Framework 4.8 updates are available\u00a0via Windows Update, Windows Server Update Services, Microsoft Update Catalog.\u00a0 Updates for other versions of\u00a0.NET Framework are part of the Windows 10 Monthly Cumulative Update.<\/p>\n

Note<\/strong>: Customers that rely on Windows Update and Windows Server Update Services will automatically receive the .NET Framework version-specific updates. Advanced system administrators can also take use of the below direct Microsoft Update Catalog download links to .NET Framework-specific updates. Before applying these updates, please ensure that you carefully review the .NET Framework version applicability, to ensure that you only install updates on systems where they apply.<\/p>\n

The following table is for Windows 10 and Windows Server 2016+ versions.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Product Version<\/th>\nCumulative Update<\/th>\n<\/tr>\n<\/thead>\n
Windows 10 1903 (May 2019 Update)\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/strong><\/td>\n\u00a0<\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5, 4.8<\/td>\nCatalog<\/a>\n4514359<\/a><\/td>\n<\/tr>\n
Windows 10 1809 (October 2018 Update)\nWindows Server 2019<\/strong><\/td>\n\n4514601<\/a><\/strong> <\/td>\n<\/tr>\n
.NET Framework 3.5, 4.7.2<\/td>\nCatalog<\/a>\n4514366<\/a><\/td>\n<\/tr>\n
.NET Framework 3.5, 4.8<\/td>\nCatalog<\/a>\n4514358<\/a><\/td>\n<\/tr>\n
Windows 10 1803 (April 2018 Update)<\/strong><\/td>\n\u00a0<\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5, 4.7.2<\/td>\nCatalog<\/a>\n4516058<\/a><\/td>\n<\/tr>\n
.NET Framework 4.8<\/td>\nCatalog<\/a>\n4514357<\/a><\/td>\n<\/tr>\n
Windows 10 1709 (Fall Creators Update)\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/strong><\/td>\n\u00a0<\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5, 4.7.1, 4.7.2<\/td>\nCatalog<\/a>\n4516066<\/a><\/td>\n<\/tr>\n
.NET Framework 4.8<\/td>\nCatalog<\/a>\n4514356<\/a><\/td>\n<\/tr>\n
Windows 10 1703 (Creators Update)<\/strong><\/td>\n <\/p>\n

 <\/td>\n<\/tr>\n

.NET Framework 3.5, 4.7, 4.7.1, 4.7.2<\/td>\nCatalog<\/a>\n4516068<\/a><\/td>\n<\/tr>\n
.NET Framework 4.8<\/td>\nCatalog<\/a>\n4514355<\/a><\/td>\n<\/tr>\n
Windows 10 1607 (Anniversary Update)\nWindows Server 2016<\/strong><\/td>\n\u00a0<\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2<\/td>\nCatalog<\/a>\n4516044<\/a><\/td>\n<\/tr>\n
.NET Framework 4.8<\/td>\nCatalog<\/a>\n4514354<\/a><\/td>\n<\/tr>\n
Windows 10 1507<\/strong><\/td>\n\u00a0<\/strong><\/td>\n<\/tr>\n
.NET Framework 3.5, 4.6, 4.6.1, 4.6.2<\/td>\nCatalog<\/a>\n4516070<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

The following table is for earlier Windows and Windows Server versions.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Product Version<\/th>\nSecurity and Quality Rollup<\/th>\nSecurity Only Update<\/th>\n<\/tr>\n<\/thead>\n
Windows 8.1\nWindows RT 8.1\nWindows Server 2012 R2<\/strong><\/td>\n\nCatalog<\/a>\n4514604<\/a><\/strong> <\/td>\n\nCatalog<\/a>\n4514599<\/a><\/strong> <\/td>\n<\/tr>\n
.NET Framework 3.5<\/td>\nCatalog<\/a>\n4514371<\/a><\/td>\nCatalog<\/a>\n4514350<\/a><\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\nCatalog<\/a>\n4514367<\/a><\/td>\nCatalog<\/a>\n4514341<\/a><\/td>\n<\/tr>\n
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2<\/td>\nCatalog<\/a>\n4514364<\/a><\/td>\nCatalog<\/a>\n4514338<\/a><\/td>\n<\/tr>\n
.NET Framework 4.8<\/td>\nCatalog<\/a>\n4514361<\/a><\/td>\nCatalog<\/a>\n4514331<\/a><\/td>\n<\/tr>\n
 <\/p>\n

Windows Server 2012<\/strong><\/p>\n

 <\/td>\n

 <\/p>\n

Catalog<\/a>\n4514603<\/a><\/strong><\/p>\n

 <\/td>\n

 <\/p>\n

Catalog<\/a>\n4514598<\/a><\/strong><\/p>\n

 <\/td>\n<\/tr>\n

.NET Framework 3.5<\/td>\nCatalog<\/a>\n4514370<\/a><\/td>\nCata<\/a>log<\/a>\n45<\/a>14349<\/a><\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\nCatalog<\/a>\n4514368<\/a><\/td>\nCatalog<\/a>\n4514342<\/a><\/td>\n<\/tr>\n
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2<\/td>\nCatalog<\/a>\n4514363<\/a><\/td>\nCatalog<\/a>\n4514337<\/a><\/td>\n<\/tr>\n
.NET Framework 4.8<\/td>\nCatalog<\/a>\n4514360<\/a><\/td>\nCatalog<\/a>\n4514330<\/a><\/td>\n<\/tr>\n
 <\/p>\n

Windows 7 SP1\nWindows Server 2008 R2 SP1<\/strong><\/p>\n

 <\/td>\n

\nCatalog<\/a>\n4514602<\/a><\/strong> <\/td>\n <\/p>\n

N\/A<\/p>\n

 <\/td>\n<\/tr>\n

.NET Framework 3.5.1<\/td>\nCatalog<\/a>\n4507004<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\nCatalog<\/a>\n4507001<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2<\/td>\nCatalog<\/a>\n4511516<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.8<\/td>\nCatalog<\/a>\n4511525<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
 <\/p>\n

Windows Server 2008<\/strong><\/p>\n

 <\/td>\n

\nCatalog<\/a>\n4514605<\/a><\/strong> <\/td>\n <\/p>\n

N\/A<\/p>\n

 <\/td>\n<\/tr>\n

.NET Framework 2.0, 3.0<\/td>\nCatalog<\/a>\n4507003<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.5.2<\/td>\nCatalog<\/a>\n4507001<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n
.NET Framework 4.6<\/td>\nCatalog<\/a>\n<\/a>4511516<\/a><\/td>\nN\/A<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/a>Docker Images<\/h3>\n

We will be updating the following .NET Framework container images later today:<\/p>\n