Updates for SharePoint 2013 (June 2021 CU)

A new cumulative update has been released for SharePoint 2013 (June 2021 CU)

SP Build: 15.0.5353.1000

This CU is a full update (Uber package), requiring no earlier updates apart from SP1.

The CU includes all SharePoint 2013 security fixes released since SP1. It does not include SP1, which is required to install this CU.

Because of its size, the CU is split into separate CAB files and one executable. Download all these files into the same installation folder before starting the update.

SharePoint 2013 CU – KB articles describing the CU:

KB 5001957 – SharePoint Foundation 2013 June 2021 CU
KB 5001961 – SharePoint Server 2013 June 2021 CU
KB 5001959 – Project Server 2013 June 2021 CU
KB 5001956 – Office Web Apps Server 2013 June 2021 CU

SharePoint 2013 CU – CU download link:

After installation, remember to run the SharePoint 2013 Products Configuration Wizard, or:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important

Before installing the CU, ensure SP1 is already installed.

Installation may take up to five hours, so I recommend reading: Speeding up CU and SP installation on SharePoint 2013.

If your farm's patch level is earlier than July 2015 CU, run PSCONFIG immediately after installing the CU to update the schema of certain search databases. More at:
https://blogs.technet.microsoft.com/stefan_gossner/2015/07/15/important-psconfig-is-mandatory-for-july-2015-cu-for-sharepoint-2013

Always install only the CU matching your product version on a SharePoint 2013 farm.

The Project Server 2013 CU already includes:

CU SharePoint Server 2013
CU SharePoint Foundation 2013.

The SharePoint Server 2013 CU already includes:

CU SharePoint Foundation 2013

Remember to update Distributed Cache as well as SharePoint; see How to update Distributed Cache correctly.

Included fixes and improvements

This CU's fixes and improvements are excerpts from official Microsoft KB articles in their original language (EN).

SharePoint Foundation 2013

This security update resolves a Microsoft SharePoint Server Remote Code Execution Vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2021-31966.

This security update resolves a Microsoft SharePoint remote code execution vulnerability, SharePoint spoofing vulnerability, SharePoint Server remote code execution vulnerability, and SharePoint Server information disclosure vulnerability. To learn more about these vulnerabilities, see:

Known issue in this update

DataFormWebPart may be blocked from accessing an external URL, and it generates “8scdc”event tags in SharePoint Unified Logging System (ULS) logs. For more information, see KB 5004210.

SharePoint Enterprise Server 2013

This security update resolves a Microsoft SharePoint Server remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2021-31963 and Microsoft Common Vulnerabilities and Exposures CVE-2021-31966.

This update provides security improvements for Access Services in SharePoint Server.

Known issues in this update

When third-party assemblies try to access some sensitive properties, user code might be blocked. When this issue occurs, “8gaol” event entries are logged in SharePoint Unified Logging System (ULS) logs. For example, you may find the following entry in ULS logs: 8gaol Unable to access this sensitive property : <sensitive property name> from outer assembly.

To fix this issue, install KB5002013 and follow the guidance in KB5004581 to enable trusted third-party assemblies.

Office Web Apps Server 2013

This security update resolves a Microsoft Excel remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2021-31939.