Updates for SharePoint Server 2016 (December 2024 CU)

15.12.2024    |    komentáře   komentářů: 0

A new cumulative update (December 2024 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5478.1000 (Language independent CU)
16.0.5478.1000 (Language dependent CU)

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002659 – December 2024 Update for SharePoint Server 2016 (language independent)
  • KB 5002544 – December 2024 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB5002659 and KB5002544 require the release version of SharePoint Enterprise Server 2016.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether enabled by this update or manually. Without an active contract at enablement, disable this experience.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB5002659 and language-dependent KB5002544 address SharePoint remote code execution, elevation of privilege and information disclosure: CVE-2024-49070, CVE-2024-49068, CVE-2024-49064, CVE-2024-49062.

KB5002659 additionally addresses Office remote code execution: CVE-2024-49065.

The core package KB5002659 includes this SharePoint Server fix:

  • Fixes an issue where the new SPSerialization allow list mechanism prevents pages containing third-party web parts or controls from loading correctly. See KB5049566.

    If ULS records 6d3sf or apmev, a farm administrator can allow a blocked type after confirming it is safe. Use the generic type name, rather than the assembly-qualified name, for blockedTypeName; double any backtick in the parameter. Run:

    add-pssnapin *
$f = get-spfarm
$f.AddGenericAllowedListValue("SPSerializationCustomizedAllowList", "<blockedTypeName>")
$f.update()
iisreset

The following improvement requires both KB5002544 and KB5002659:

  • Adds a Central Administration banner announcing the end of support for hybrid search based on Search Content Service (SCS).

Komentáře