Updates for SharePoint Server 2016 (November 2022 CU)

13.11.2022    |    komentáře   komentářů: 0

A new cumulative update (November 2022 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5369.1000 (Language independent CU)
16.0.5369.1000 (Language dependent CU)

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002305 – November 2022 Update for SharePoint Server 2016 (language independent)
  • KB 5002289 – November 2022 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

Both updates require the release version of SharePoint Enterprise Server 2016.

Enabling the modern OneDrive for Business experience, through this update or manually, requires active Software Assurance at that time. If that requirement is not met, disable the modern experience.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB 5002305 addresses remote code execution in SharePoint Server and Word, and information disclosure in Word. It covers CVE-2022-41060, CVE-2022-41061, CVE-2022-41062, CVE-2022-41103.

The language-dependent package KB 5002289 also addresses the Word vulnerabilities CVE-2022-41060, CVE-2022-41061 and CVE-2022-41103 listed above.

The language-independent package KB 5002305 updates Access Services to support newer SQL Server components. Its SQL Server 2012 dependencies are no longer supported with SharePoint Server 2016. To keep Access Services operational and supported, upgrade the following components before installing this CU. Upgrading them afterwards is also possible, but Access Services may stop working until those upgrades are complete:

  • Upgrade Microsoft SQL Server Express 2012 LocalDB to Microsoft SQL Server Express 2016 LocalDB (SqlLocalDB.msi).

  • Upgrade Microsoft System CLR Types for Microsoft SQL Server 2012 to Microsoft System CLR Types for Microsoft SQL Server 2016 SP3 (SQLSysClrTypes.msi).

  • Upgrade Microsoft SQL Server 2012 Data-Tier Application Framework to Microsoft SQL Server 2016 SP3 Data-Tier Application Framework (Dacframework.msi).

  • Upgrade Microsoft SQL Server 2012 Transact-SQL ScriptDom to Microsoft SQL Server 2016 SP3 Transact-SQL ScriptDom (SQLDOM.MSI).

After installing KB 5002305, Microsoft recommends removing Microsoft SQL Server 2012 Native Client (sqlncli.msi) from SharePoint Server 2016 virtual machines: Access Services no longer uses or supports it.

Komentáře