Description of the security update for SharePoint Server 2016: December 12, 2017
Summary
An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2017-11936.
Note To apply this security update, you must have the release version of SharePoint Server 2016 installed on the computer.This public update also delivers all the features previously included in Feature Pack 1 for SharePoint Server 2016, including:
Improvements and fixes
This security update contains improvements and fixes for the following nonsecurity issues:
- Assume that you have an enterprise resource that is a part of a team assignment pool. When you go to the Resource Center, select the resource and then click theCapacity Planning button, the resource is not displayed, and in some cases you see the error βSorry, something went wrong.β
- When you set properties that are imported from Active Directory by using the user interface, certain unchecked containers other than organization unit (OU) scope are not respected.
- Consider the following scenario:
- A project manager publishes a task to a team member.
- The team member goes to their timesheet and enters actual work on the task.
- The timesheet is submitted and then approved.
- The project in which the task exists is deleted.
- The team member goes back to their timesheet.
In this situation, the task on which the actual work was submitted is no longer there.
- This update fixes an issue where the top report part of the Search Reports would count the same queries incorrectly with different casing. For example, βqueryβ, βQUERYβ, and βQueryβ were treated as unique query texts and counted accordingly. This fix lowercases the query text before calculating the counts.
- When you search Chinese-Simplified or Chinese-Traditional content in SharePoint 2016, you may not see the relevant results or the query keywords may not be highlighted in the results. This issue occurs because the search falls back to the English word breaker when the query is Chinese-Simplified or Chinese-Traditional based. This update resolves the issue so that the correct word breaker is selected.
- When you search for keywords that contain some specific Korean characters, the search fails because the token length is calculated incorrectly.
- When you delete a value from a custom field thatβs configured to display a graphical indicator, the record in the database is not deleted, but instead the value is set to NULL, and the indicator value is preserved in reporting.
- This update reduces the default version limit number for the default document library on new SharePoint 2016 team sites from 500 down to 10. This will make storage capacity planning easier.
- This update changes the short names of the services that are using a built-in service account to friendly display names so that itβs easy to understand what service is described in the SharePoint health rules report.
- This update improves the Thai word breaker for complex compound words when you search in SharePoint.
- Translates some terms in multiple languages to make sure that the meaning is accurate.
- This update also has the following improvements:
- Improves the SharePoint Health Analyzer algorithm that checks the free space on drives to handle large drives better. The algorithm will now report a warning if the free disk space is less than 10 GB or report an error if the free disk space is less than 4 GB.
- Removes the following five health analyzer rules to reduce noise:
How to get and install the update
Method 1: Microsoft Update
This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.
Method 2: Microsoft Update Catalog
To get the stand-alone package for this update, go to the Microsoft Update Catalog website.
Method 3: Microsoft Download Center
You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.
More Information
Security update deployment information
For deployment information about this update, see security update deployment information: December 12, 2017.
Security update replacement information
This security update replaces the previously released update, KB 4011244.
File hash information
Package Name |
Package Hash SHA 1 |
Package Hash SHA 2 |
sts2016-kb4011576-fullfile-x64-glb.exe |
1393A2F066A5CFC86A1F0B2998EFA316F8D98148 |
99700E2C70182DA73387B5BA64E4E097DC387579A572B4C6F1456F57766D9D8A |
File information
For the list of files this security update KB 4011576 contains, download the file information for update 4011576.
How to get help and support for this security update
Help for installing updates: Windows Update FAQ
Security solutions for IT professionals: Security Support and Troubleshooting
Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure
Local support according to your country: International SupportPropose a feature or provide feedback on SharePoint: SharePoint User Voice portal