Lucene search

MicrosoftKB4601056

HistoryFeb 09, 2021 - 8:00 a.m.

February 9, 2021-KB4601056 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1909, and Windows Server, version 1909

2021-02-0908:00:00

Microsoft

support.microsoft.com

security update

denial of service

.net framework

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

58.1%

JSON

February 9, 2021-KB4601056 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1909, and Windows Server, version 1909

Release Date:
February 9, 2021Version: .NET Framework 3.5 and 4.8

Summary

This security update addresses a denial of service vulnerability in .NET Framework. For more information please see CVE-2021-24111.

Known issues in this update

Symptom| After installing this update, WPF apps may crash with a callstack similar to`

Exception Info: System.NullReferenceException at System.Windows.Interop.HwndMouseInputProvider.HasCustomChrome(System.Windows.Interop.HwndSource, RECT ByRef)
at System.Windows.Interop.HwndMouseInputProvider.GetEffectiveClientRect(IntPtr)
at System.Windows.Interop.HwndMouseInputProvider.PossiblyDeactivate(IntPtr, Boolean)
at System.Windows.Interop.HwndMouseInputProvider.Dispose()

`This occurs when disposing an HwndSource whose RootVisual is null, a situation that arises in Visual Studio when docking or splitting windows, and could arise in other apps.
—|—
Workaround| This issue is resolved in KB4601556.

How to get this update

Install this updateRelease Channel	Available	Next Step
Windows Update and Microsoft Update	Yes	None. This update will be downloaded and installed automatically from Windows Update.
Microsoft Update Catalog	Yes	To get the standalone package for this update, go to the Microsoft Update Catalog website.
Windows Server Update Services (WSUS)	Yes	This update will automatically sync with WSUS if you configure Products and Classifications as follows:Product: Windows 10, version 1909, and Windows Server, version 1909Classification: Security Updates File informationFor a list of the files that are provided in this update, download the file information for cumulative update.