Summary

This security update resolves a privately reported vulnerability in Windows Error Reporting (WER). The vulnerability could allow security feature bypass if it was successfully exploited by an attacker. An attacker who successfully exploited this vulnerability could gain access to the memory of a running process. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate by using administrative user rights.

Introduction

Microsoft has released security bulletin MS15-006. To learn more about this security bulletin:

How to obtain help and support for this security update

Help installing updates:
Support for Microsoft Update

Security solutions for IT professionals:
TechNet Security Troubleshooting and Support

Help protect your Windows-based computer from viruses and malware:
Virus Solution and Security Center

Local support according to your country:
International Support

More Information

Windows 8 and Windows 8.1 (all editions)Reference Table

The following table contains the security update information for this software.

Security update file name

For all supported 32-bit editions of Windows 8:
Windows8-RT-KB3004365-x86.msu

For all supported x64-based editions of Windows 8:
Windows8-RT-KB3004365-x64.msu

For all supported 32-bit editions of Windows 8.1:
Windows8.1-KB3004365-x86.msu

For all supported x64-based editions of Windows 8.1:
Windows8.1-KB3004365-x64.msu

Installation switches

See Microsoft Knowledge Base Article 934307

Restart requirement

This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, you receive a message that advises you to restart.

Removal information

To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.

File information

See the file information section.

Registry key verification

Note A registry key does not exist to validate the presence of this update.

Windows Server 2012 and Windows Server 2012 R2 (all editions)Reference Table

The following table contains the security update information for this software.

Security update file name

For all supported editions of Windows Server 2012:
Windows8-RT-KB3004365-x64.msu

For all supported editions of Windows Server 2012 R2:
Windows8.1-KB3004365-x64.msu

Installation switches

See Microsoft Knowledge Base Article 934307

Restart requirement

This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, you receive a message that advises you to restart.

Removal information

To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.

File information

See the file information section.

Registry key verification

Note A registry key does not exist to validate the presence of this update.

Windows RT and Windows RT 8.1 (all editions)Reference Table

The following table contains the security update information for this software.

Deployment

These updates are available through Windows Update only.

Restart requirement

You must restart your system after you apply this security update.

Removal information

Click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.


File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.


  • The files that apply to a specific product, milestone (RTM,SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

    Version

    Product

    Milestone

    Service branch

    6.2.920 0.16 xxx

    Windows 8 and Windows Server 2012

    RTM

    GDR

    6.2.920 0.20 xxx

    Windows 8 and Windows Server 2012

    RTM

    LDR

  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

Note The MANIFEST files (.manifest) and MUM files (.mum) that are installed are not listed.

For all supported x86-based versions of Windows 8

File name

File version

File size

Date

Time

Platform

Audiodg.exe

6.2.9200.16578

207,576

08-Apr-2013

23:37

x86

Audioendpointbuilder.dll

6.2.9200.17131

136,704

02-Oct-2014

22:30

x86

Audioeng.dll

6.2.9200.16578

426,024

08-Apr-2013

23:37

x86

Audiokse.dll

6.2.9200.16451

463,768

06-Nov-2012

05:00

x86

Audioses.dll

6.2.9200.16578

324,368

08-Apr-2013

23:37

x86

Audiosrv.dll

6.2.9200.17134

596,480

02-Oct-2014

22:30

x86

Encdump.dll

5.0.1.1

100,864

06-Dec-2014

06:09

x86

Prod_audio-audiocore.ptxml

Not applicable

667

05-Nov-2012

23:35

Not applicable

Audiodg.exe

6.2.9200.20555

207,552

06-Nov-2012

06:36

x86

Audioendpointbuilder.dll

6.2.9200.21247

136,704

02-Oct-2014

22:32

x86

Audioeng.dll

6.2.9200.20555

427,568

06-Nov-2012

06:36

x86

Audiokse.dll

6.2.9200.20555

463,768

06-Nov-2012

06:36

x86

Audioses.dll

6.2.9200.20555

324,344

06-Nov-2012

06:36

x86

Audiosrv.dll

6.2.9200.21251

593,920

02-Oct-2014

22:32

x86

Encdump.dll

5.0.1.1

100,864

06-Dec-2014

05:40

x86

Prod_audio-audiocore.ptxml

Not applicable

667

05-Nov-2012

23:38

Not applicable

Wer.dll

6.2.9200.17199

355,840

06-Dec-2014

06:10

x86

Werdiagcontroller.dll

6.2.9200.16384

29,184

26-Jul-2012

03:20

x86

Wermgr.exe

6.2.9200.16384

131,536

26-Jul-2012

03:32

x86

Wer.dll

6.2.9200.21316

355,840

06-Dec-2014

05:42

x86

Werdiagcontroller.dll

6.2.9200.16384

29,184

26-Jul-2012

03:20

x86

Wermgr.exe

6.2.9200.16384

131,536

26-Jul-2012

03:32

x86

Faultrep.dll

6.2.9200.17199

332,800

06-Dec-2014

06:09

x86

Werfault.exe

6.2.9200.16659

385,768

09-Jul-2013

04:25

x86

Werfaultsecure.exe

6.2.9200.17199

23,552

06-Dec-2014

06:10

x86

Faultrep.dll

6.2.9200.21316

332,800

06-Dec-2014

05:40

x86

Werfault.exe

6.2.9200.20767

385,776

09-Jul-2013

05:26

x86

Werfaultsecure.exe

6.2.9200.21316

23,552

06-Dec-2014

05:42

x86

For all supported x64-based versions of Windows 8 and Windows Server 2012

File name

File version

File size

Date

Time

Platform

Audiodg.exe

6.2.9200.16579

253,544

09-Apr-2013

05:33

x64

Audioendpointbuilder.dll

6.2.9200.17131

169,472

02-Oct-2014

22:29

x64

Audioeng.dll

6.2.9200.16579

489,576

09-Apr-2013

05:33

x64

Audiokse.dll

6.2.9200.17131

522,728

03-Oct-2014

01:21

x64

Audioses.dll

6.2.9200.16579

446,792

09-Apr-2013

05:33

x64

Audiosrv.dll

6.2.9200.17199

783,872

06-Dec-2014

07:50

x64

Encdump.dll

5.0.1.1

267,264

06-Dec-2014

07:51

x64

Prod_audio-audiocore.ptxml

Not applicable

667

05-Nov-2012

23:32

Not applicable

Audiodg.exe

6.2.9200.20555

253,512

06-Nov-2012

07:18

x64

Audioendpointbuilder.dll

6.2.9200.21247

169,472

02-Oct-2014

22:29

x64

Audioeng.dll

6.2.9200.20555

490,064

06-Nov-2012

07:18

x64

Audiokse.dll

6.2.9200.21247

522,728

03-Oct-2014

01:06

x64

Audioses.dll

6.2.9200.20555

447,792

06-Nov-2012

07:18

x64

Audiosrv.dll

6.2.9200.21316

783,872

06-Dec-2014

06:39

x64

Encdump.dll

5.0.1.1

267,264

06-Dec-2014

06:40

x64

Prod_audio-audiocore.ptxml

Not applicable

667

05-Nov-2012

23:36

Not applicable

Wer.dll

6.2.9200.17199

458,240

06-Dec-2014

07:53

x64

Werdiagcontroller.dll

6.2.9200.16384

33,792

26-Jul-2012

03:07

x64

Wermgr.exe

6.2.9200.16384

136,768

26-Jul-2012

04:51

x64

Wer.dll

6.2.9200.21316

442,880

06-Dec-2014

06:42

x64

Werdiagcontroller.dll

6.2.9200.16384

33,792

26-Jul-2012

03:07

x64

Wermgr.exe

6.2.9200.16384

136,768

26-Jul-2012

04:51

x64

Faultrep.dll

6.2.9200.17199

370,688

06-Dec-2014

07:51

x64

Werfault.exe

6.2.9200.16659

439,488

09-Jul-2013

06:18

x64

Werfaultsecure.exe

6.2.9200.17199

26,112

06-Dec-2014

07:53

x64

Faultrep.dll

6.2.9200.21316

370,688

06-Dec-2014

06:40

x64

Werfault.exe

6.2.9200.20767

439,488

09-Jul-2013

08:35

x64

Werfaultsecure.exe

6.2.9200.21316

26,112

06-Dec-2014

06:43

x64

Audioeng.dll

6.2.9200.16578

426,024

08-Apr-2013

23:37

x86

Audiokse.dll

6.2.9200.16451

463,768

06-Nov-2012

05:00

x86

Audioses.dll

6.2.9200.16578

324,368

08-Apr-2013

23:37

x86

Prod_wow64_audio-audiocore.ptxml

Not applicable

667

05-Nov-2012

23:35

Not applicable

Audioeng.dll

6.2.9200.20555

427,568

06-Nov-2012

06:36

x86

Audiokse.dll

6.2.9200.20555

463,768

06-Nov-2012

06:36

x86

Audioses.dll

6.2.9200.20555

324,344

06-Nov-2012

06:36

x86

Prod_wow64_audio-audiocore.ptxml

Not applicable

667

05-Nov-2012

23:38

Not applicable

Wer.dll

6.2.9200.17199

355,840

06-Dec-2014

06:10

x86

Werdiagcontroller.dll

6.2.9200.16384

29,184

26-Jul-2012

03:20

x86

Wermgr.exe

6.2.9200.16384

131,536

26-Jul-2012

03:32

x86

Wer.dll

6.2.9200.21316

355,840

06-Dec-2014

05:42

x86

Werdiagcontroller.dll

6.2.9200.16384

29,184

26-Jul-2012

03:20

x86

Wermgr.exe

6.2.9200.16384

131,536

26-Jul-2012

03:32

x86

Faultrep.dll

6.2.9200.17199

332,800

06-Dec-2014

06:09

x86

Werfault.exe

6.2.9200.16659

385,768

09-Jul-2013

04:25

x86

Werfaultsecure.exe

6.2.9200.17199

23,552

06-Dec-2014

06:10

x86

Faultrep.dll

6.2.9200.21316

332,800

06-Dec-2014

05:40

x86

Werfault.exe

6.2.9200.20767

385,776

09-Jul-2013

05:26

x86

Werfaultsecure.exe

6.2.9200.21316

23,552

06-Dec-2014

05:42

x86


For all supported x86-based versions of Windows 8.1

File name

File version

File size

Date

Time

Platform

Audiodg.exe

6.3.9600.17415

213,336

29-Oct-2014

03:07

x86

Audioendpointbuilder.dll

6.3.9600.17893

193,536

30-May-2015

19:24

x86

Audioeng.dll

6.3.9600.17415

424,544

29-Oct-2014

03:07

x86

Audiokse.dll

6.3.9600.17415

344,536

29-Oct-2014

03:07

x86

Audioses.dll

6.3.9600.17415

370,424

29-Oct-2014

03:07

x86

Audiosrv.dll

6.3.9600.17893

694,272

30-May-2015

19:24

x86

Encdump.dll

5.0.1.1

108,944

08-Dec-2014

19:46

x86

Prod_audio-audiocore.ptxml

Not Applicable

667

21-Aug-2013

23:39

Not Applicable

Boot.stl

Not Applicable

4,330

05-Dec-2014

23:11

Not Applicable

Ci.dll

6.3.9600.17550

485,544

08-Dec-2014

19:46

x86

Driver.stl

Not Applicable

4,461

30-May-2015

17:09

Not Applicable

Wer.dll

6.3.9600.17550

448,792

08-Dec-2014

19:42

x86

Werdiagcontroller.dll

6.3.9600.17415

33,280

29-Oct-2014

01:59

x86

Wermgr.exe

6.3.9600.17415

136,296

29-Oct-2014

03:12

x86

Faultrep.dll

6.3.9600.17550

372,408

08-Dec-2014

19:42

x86

Werfault.exe

6.3.9600.17415

413,136

29-Oct-2014

03:12

x86

Werfaultsecure.exe

6.3.9600.17550

33,584

08-Dec-2014

19:42

x86

For all supported x64-based versions of Windows 8.1 and Windows Server 2012 R2

File name

File version

File size

Date

Time

Platform

Audiodg.exe

6.3.9600.17415

272,248

29-Oct-2014

03:52

x64

Audioendpointbuilder.dll

6.3.9600.17893

230,400

30-May-2015

19:36

x64

Audioeng.dll

6.3.9600.17415

482,872

29-Oct-2014

03:52

x64

Audiokse.dll

6.3.9600.17415

394,120

29-Oct-2014

03:52

x64

Audioses.dll

6.3.9600.17415

500,016

29-Oct-2014

03:52

x64

Audiosrv.dll

6.3.9600.17893

911,360

30-May-2015

19:35

x64

Encdump.dll

5.0.1.1

108,944

08-Dec-2014

19:42

x64

Prod_audio-audiocore.ptxml

Not Applicable

667

22-Aug-2013

06:45

Not Applicable

Boot.stl

Not Applicable

4,330

05-Dec-2014

23:12

Not Applicable

Ci.dll

6.3.9600.17550

531,616

08-Dec-2014

19:42

x64

Driver.stl

Not Applicable

4,575

30-May-2015

17:10

Not Applicable

Wer.dll

6.3.9600.17550

535,640

08-Dec-2014

19:42

x64

Werdiagcontroller.dll

6.3.9600.17893

37,888

30-May-2015

21:18

x64

Wermgr.exe

6.3.9600.17415

139,984

29-Oct-2014

04:00

x64

Faultrep.dll

6.3.9600.17550

413,248

08-Dec-2014

19:42

x64

Werfault.exe

6.3.9600.17415

465,320

29-Oct-2014

04:00

x64

Werfaultsecure.exe

6.3.9600.17550

38,264

08-Dec-2014

19:42

x64

Audioeng.dll

6.3.9600.17415

424,544

29-Oct-2014

03:07

x86

Audiokse.dll

6.3.9600.17415

344,536

29-Oct-2014

03:07

x86

Audioses.dll

6.3.9600.17415

370,424

29-Oct-2014

03:07

x86

Prod_wow64_audio-audiocore.ptxml

Not Applicable

667

21-Aug-2013

23:39

Not Applicable

Wer.dll

6.3.9600.17550

448,792

08-Dec-2014

19:42

x86

Werdiagcontroller.dll

6.3.9600.17415

33,280

29-Oct-2014

01:59

x86

Wermgr.exe

6.3.9600.17415

136,296

29-Oct-2014

03:12

x86

Faultrep.dll

6.3.9600.17550

372,408

08-Dec-2014

19:42

x86

Werfault.exe

6.3.9600.17415

413,136

29-Oct-2014

03:12

x86

Werfaultsecure.exe

6.3.9600.17550

33,584

08-Dec-2014

19:42

x86


File name

SHA1 hash

SHA256 hash

Windows8.1-KB3004365-v2-x64.msu

4D9891519D70BCCAC36D7C1226247A1DE8B6CB97

B61917FAB76306DDB426CB9D1712ADA9E48B0C19AD4C078F16286314941C2650

Windows8.1-KB3004365-v2-x86.msu

0B0B3375482ECA8D3918E99BBC82E850E949F722

D58C35DED78A5A5CF2E16BBF8729AF67C3E5946305B68B5A62918ED9CB7E05E5

Windows8.1-KB3004365-x86.msu

6D985E763ABD12FC20FC3BD0853BF3E3F5B6FE86

E23A052BEE6AF013C4921DEF2F4792DBE6ADF51113E60326DC258E4520A0CAF9

Windows8-RT-KB3004365-x86.msu

BDD6C736608DF9B54AA5C119F3768E3F89971FCD

0377F08496CCC3C7668CF7751DAD2EC3894F9487386E49101DE3233B8DA3CD9C


Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Any additional feedback? (Optional)

Thank you for your feedback!

×