A new cumulative update for SharePoint Server 2016 has been released (September 2019 CU).
This CU includes both Feature Pack 2, which has been included since the September CU (September 2017 CU), and the previous Feature Pack 1.
SP Build:
16.0.4900.1000 (Language independent CU)
16.0.4900.1000 (Language dependent CU)
SharePoint 2016 CU – KB articles describing the CU:
- KB 4475590 – September 2019 Update for SharePoint Server 2016 (language independent)
- KB 4475594 – September 2019 Update for SharePoint Server 2016 (language dependent)
SharePoint Server 2016 CU – CU download link:
- Download September 2019 Update for SharePoint Server 2016 (language independent)
- Download September 2019 Update for SharePoint Server 2016 (language dependent)
After installation, remember to run the SharePoint 2016 Products Configuration Wizard (SharePoint 2016 Products Configuration Wizard), or the following command:
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install
Notice
Feature Pack 2 also includes all functionality from Feature Pack 1.
Always install both packages in this order:
- language independent (updates language-independent components)
- language dependent (updates language-dependent components)
For language-dependent packages, it does not matter which language you select, as each package contains updates for all languages.
If you install a new language pack on your SharePoint Server 2016 farm, you must then reinstall the language-dependent update package.
Remember that Distributed Cache must also be updated alongside SharePoint; see How to update Distributed Cache correctly and for Office Online Server, you must have the current RTM release; see How to update Office Online Server.
Included fixes and improvements
The fixes and improvements listed for this CU are excerpts from official Microsoft KB articles in their original language (EN).
SharePoint Server 2016
This security update resolves a remote code execution vulnerability that exists in Microsoft SharePoint if the software does not check the source markup of an application package. To learn more about this vulnerability, see the following security advisories:
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1257
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1260
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1261
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1295
- Microsoft Common Vulnerabilities and Exposures CVE-2019-1296
This security update resolves an elevation of privilege vulnerability that exists in Microsoft SharePoint. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2019-1260.
This security update contains the following improvements in SharePoint Enterprise Server 2016:
- Uninstalling an app when the second stage recycle bin is cleared now occurs only if no instances of the app currently exist.
- With this update, in-place searches will now look for only results within the currently viewed folder. This greatly improves the search experience within a folder in large libraries that have files that spread across multiple folders.
This security update contains fixes for the following nonsecurity issues in SharePoint Enterprise Server 2016:
- When you attach a content database from a previous version of SharePoint Server to SharePoint Server 2016, any existing “Table of Contents” web parts in that database always have the “Show content from starting location” setting enabled after the upgrade. This update fixes this issue by preserving the original setting during the upgrade.
- You randomly receive a FedAuth cookie even though you have enabled Windows Authentication as the only authentication provider on your web application.
Note To fix this issue completely, you must install KB 4475594 together with this update.
This security update contains improvements and fixes for the following nonsecurity issues in Project Server 2016:
- Users can now add tasks while editing a project in the Schedule view when the Project Summary Task option is selected.
- You can now receive information about any type kind of completed queue jobs for a project when you use the new GetAll() method from a REST call.
- When the Schedule Variance Percentage (SVP) earned value becomes very large, it causes an overflow condition that prevents Project Web App (PWA) project views from loading. The SVP value now has a lower limit of -100% and upper limit of 100%.
Komentáře