MS15-128: Security update for Microsoft graphics component to address remote code execution: December 8, 2015

Security update file names

For all supported 32-bit editions of Windows Vista:
Windows6.0-KB3109094-x86.msu

For the Microsoft .NET Framework 3.0 Service Pack 2 when installed on all supported 32-bit editions of Windows Vista:
Windows6.0-KB3099860-x86.msu

For the Microsoft .NET Framework 4 when installed on all supported 32-bit editions of Windows Vista:
NDP40-KB3099866-x86.exe

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2 when installed on all supported 32-bit editions of Windows Vista:
NDP45-KB3099869-x86.exe

For the Microsoft .NET Framework 4.6 when installed on all supported 32-bit editions of Windows Vista:
NDP46-KB3099874-x86.exe

For all supported x64-based editions of Windows Vista:
Windows6.0-KB3109094-x64.msu

For the Microsoft .NET Framework 3.0 Service Pack 2 when installed on all supported x64-based editions of Windows Vista:
Windows6.0-KB3099860-x64.msu

For the Microsoft .NET Framework 4 when installed on all supported x64-based editions of Windows Vista:
NDP40-KB3099866-x64.exe

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2 when installed on all supported x64-based editions of Windows Vista:
NDP45-KB3099869-x64.exe

For the Microsoft .NET Framework 4.6 when installed on all supported x64-based editions of Windows Vista:
NDP46-KB3099874-x64.exe

Installation switches

For Microsoft Windows, see Microsoft Knowledge Base Article 934307

For the Microsoft .NET Framework, see Microsoft Knowledge Base Article 2844699

Update log file

For Windows Vista:
Not applicable

For the Microsoft .NET Framework 3.0 Service Pack 2:
Microsoft .NET Framework 3.0-KB3099860_*-msi0.txt
Microsoft .NET Framework 3.0-KB3099860_*.html

For the Microsoft .NET Framework 4:
KB3099866_*_*-Microsoft .NET Framework 4 Client Profile-MSP0.txt
KB3099866_*_*.html

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2:
KB3099869_*_*-Microsoft .NET Framework [.NET target version]-MSP0.txt
KB3099869_*_*.html

For the Microsoft .NET Framework 4.6:
KB3099874_*_*-Microsoft .NET Framework 4.6-MSP0.txt
KB3099874_*_*.html

Restart requirement

For Windows Vista:
Yes, you must restart your system after you apply this security update.

For the Microsoft .NET Framework:
This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

Removal information

For Windows Vista:
WUSA.exe does not support uninstalling updates. To uninstall an update that is installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

For the Microsoft .NET Framework:
Click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

File information

See Microsoft Knowledge Base Article 3109094
See Microsoft Knowledge Base Article 3099860
See Microsoft Knowledge Base Article 3099866
See Microsoft Knowledge Base Article 3099869
See Microsoft Knowledge Base Article 3099874

Registry key verification

For Windows Vista:
A registry key does not exist to validate the presence of this update.

For the Microsoft .NET Framework 3.0 Service Pack 2:
A registry key does not exist to validate the presence of this update. Use WMI to detect for the presence of this update.

For the Microsoft .NET Framework 4 when installed on all supported 32-bit editions of Windows Vista:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 4 Client Profile\KB3099866
”ThisVersionInstalled” = “Y”

For the Microsoft .NET Framework 4 when installed on all supported x64-based editions of Windows Vista:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Updates\Microsoft .NET Framework 4 Client Profile\KB3099866
”ThisVersionInstalled” = “Y”

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework [.NET target version]\KB3099869
”ThisVersionInstalled” = “Y”

For the Microsoft .NET Framework 4.6:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 4.6\KB3099874
"ThisVersionInstalled" = "Y"

Security update file names

For all supported 32-bit editions of Windows Server 2008:
Windows6.0-KB3109094-x86.msu

For the Microsoft .NET Framework 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2:
Windows6.0-KB3099860-x86.msu

For the Microsoft .NET Framework 4 when installed on all supported 32-bit editions of Windows Server 2008 Service Pack 2:
NDP40-KB3099866-x86.exe

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2 when installed on all supported 32-bit editions of Windows Server 2008 Service Pack 2:
NDP45-KB3099869-x86.exe

For the Microsoft .NET Framework 4.6 when installed on all supported 32-bit editions of Windows Server 2008 Service Pack 2:
NDP46-KB3099874-x86.exe

For all supported x64-based editions of Windows Server 2008:
Windows6.0-KB3109094-x64.msu

For the Microsoft .NET Framework 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2:
Windows6.0-KB3099860-x64.msu

For the Microsoft .NET Framework 4 when installed on all supported x64-based editions of Windows Server 2008 Service Pack 2:
NDP40-KB3099866-x64.exe

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2 on all supported x64-based editions of Windows Server 2008 Service Pack 2:
NDP45-KB3099869-x64.exe

For the Microsoft .NET Framework 4.6 on all supported x64-based editions of Windows Server 2008 Service Pack 2:
NDP46-KB3099874-x64.exe

For all supported Itanium-based editions of Windows Server 2008:
Windows6.0-KB3109094-ia64.msu

Installation switches

For Microsoft Windows, see Microsoft Knowledge Base Article 934307

For the Microsoft .NET Framework, see Microsoft Knowledge Base Article 2844699

Update log file

For Windows Server 2008:
Not applicable

For the Microsoft .NET Framework 3.0 Service Pack 2:
Microsoft .NET Framework 3.0-KB3099860_*-msi0.txt
Microsoft .NET Framework 3.0-KB3099860_*.html

For the Microsoft .NET Framework 4:
KB3099866_*_*-Microsoft .NET Framework 4 Client Profile-MSP0.txt
KB3099866_*_*.html

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2:
KB3048077_*_*-Microsoft .NET Framework [.NET target version]-MSP0.txt
KB3099869_*_*.html

For the Microsoft .NET Framework 4.6:
KB3099874_*_*-Microsoft .NET Framework 4.6-MSP0.txt
KB3099874_*_*.html

Restart requirement

For Windows Server 2008:
Yes, you must restart your system after you apply this security update.

For the Microsoft .NET Framework:
This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

Removal information

For Windows Server 2008:
WUSA.exe does not support uninstalling updates. To uninstall an update that is installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

For the Microsoft .NET Framework:
Click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

File information

See Microsoft Knowledge Base Article 3109094
See Microsoft Knowledge Base Article 3099860
See Microsoft Knowledge Base Article 3099866
See Microsoft Knowledge Base Article 3099869
See Microsoft Knowledge Base Article 3099874

Registry key verification

For Windows Server 2008:
A registry key does not exist to validate the presence of this update.

For the Microsoft .NET Framework 3.0 Service Pack 2:
A registry key does not exist to validate the presence of this update. Use WMI to detect for the presence of this update.

For the Microsoft .NET Framework 4 when installed on all supported 32-bit editions of Windows Server 2008:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 4 Client Profile\KB3099866
”ThisVersionInstalled” = “Y”

For the Microsoft .NET Framework 4 when installed on all supported x64-based editions of Windows Server 2008:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Updates\Microsoft .NET Framework 4 Client Profile\KB3099866
”ThisVersionInstalled” = “Y”

For the Microsoft .NET Framework 4.5/4.5.1/4.5.2:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework [.NET target version]\KB3099869
”ThisVersionInstalled” = “Y”

For the Microsoft .NET Framework 4.6 RC and 4.6:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Microsoft .NET Framework 4.6\KB3099874
"ThisVersionInstalled" = "Y"

Security update file name

For all supported 32-bit editions of Windows 7:
Windows6.1-KB3109094-x86.msu

For the Microsoft .NET Framework 3.5.1 on all supported 32-bit editions of Windows 7 Service Pack 1:
Windows6.1-KB3099862-x86.msu

For all supported x64-based editions of Windows 7:
Windows6.1-KB3109094-x64.msu

For the Microsoft .NET Framework 3.5.1 on all supported x64-based editions of Windows 7 Service Pack 1:
Windows6.1-KB3099862-x64.msu

Installation switches

For Microsoft Windows, see Microsoft Knowledge Base Article 934307

For the Microsoft .NET Framework, see Microsoft Knowledge Base Article 2844699

Update log file

For Windows 7:
Not applicable

For the Microsoft .NET Framework 3.5.1:
Not applicable.

Restart requirement

For Windows 7:
Yes, you must restart your system after you apply this security update.

For the Microsoft .NET Framework:
This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

Removal information

For Windows 7:
To uninstall an update that is installed by WUSA, use the /Uninstall setup switch, or click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

For the Microsoft .NET Framework:
Click Control Panel, click System and Security, and then under Windows Update, click View installed updates, and then select from the list of updates.

File information

See Microsoft Knowledge Base Article 3109094
See Microsoft Knowledge Base Article 3099862

Registry key verification

For Windows 7:
A registry key does not exist to validate the presence of this update.

For the Microsoft .NET Framework 3.5.1:
A registry key does not exist to validate the presence of this update. Use WMI to detect for the presence of this update.

Security update file name

For all supported x64-based editions of Windows Server 2008 R2:
Windows6.1-KB3109094-x64.msu

For the Microsoft .NET Framework 3.5.1 on all supported x64-based editions of Windows Server 2008 R2 Service Pack 1:
Windows6.1-KB3099862-x64.msu

For all supported Itanium-based editions of Windows Server 2008 R2:
Windows6.1-KB3109094-ia64.msu

Installation switches

For Microsoft Windows, see Microsoft Knowledge Base Article 934307

For the Microsoft .NET Framework, see Microsoft Knowledge Base Article 2844699

Update log file

For Windows Server 2008 R2:
Not applicable

For the Microsoft .NET Framework 3.5.1:
Not applicable

Restart requirement

For Windows Server 2008 R2:
Yes, you must restart your system after you apply this security update.

For the Microsoft .NET Framework:
This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

Removal information

For Windows Server 2008 R2:
To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

For the Microsoft .NET Framework:
Click Control Panel, click System and Security, and then under Windows Update, click View installed updates, and then select from the list of updates.

File information

See Microsoft Knowledge Base Article 3109094
See Microsoft Knowledge Base Article 3099862

Registry key verification

For Windows Server 2008 R2:
A registry key does not exist to validate the presence of this update.

For the Microsoft .NET Framework 3.5.1:
A registry key does not exist to validate the presence of this update. Use WMI to detect for the presence of this update.

Security update file name

For all supported 32-bit editions of Windows 8:
Windows8-RT-KB3109094-x86.msu

For the Microsoft .NET Framework 3.5 on Windows 8 for 32-bit Systems:
Windows8-RT-KB3099863-x86.msu

For all supported x64-based editions of Windows 8:
Windows8-RT-KB3109094-x64.msu

For the Microsoft .NET Framework 3.5 on Windows 8 for x64-based Systems:
Windows8-RT-KB3099863-x64.msu

For all supported 32-bit editions of Windows 8.1:
Windows8.1-KB3109094-x86.msu

For the Microsoft .NET Framework 3.5 on Windows 8.1 for 32-bit Systems:
Windows8.1-KB3099864-x86.msu

For all supported x64-based editions of Windows 8.1:
Windows8.1-KB3109094-x64.msu

For the Microsoft .NET Framework 3.5 on Windows 8.1 for x64-based Systems:
Windows8.1-KB3099864-x64.msu

Installation switches

For Microsoft Windows, see Microsoft Knowledge Base Article 934307

For the Microsoft .NET Framework, see Microsoft Knowledge Base Article 2844699

Restart requirement

For Windows 8 and Windows 8.1:
Yes, you must restart your system after you apply this security update.

For the Microsoft .NET Framework:
This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

Removal information

For Windows 8 and Windows 8.1:
To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

For the Microsoft .NET Framework:
Click Control Panel, click System and Security, and then under Windows Update, click View update history and then select from the list of updates.

File information

See Microsoft Knowledge Base Article 3109094
See Microsoft Knowledge Base Article 3099863
See Microsoft Knowledge Base Article 3099864

Registry key verification

Registry keys do not exist to validate the presence of these updates.

Security update file name

For all supported editions of Windows Server 2012:
Windows8-RT-KB3109094-x64.msu

For the Microsoft .NET Framework 3.5 on Windows Server 2012:
Windows8-RT-KB3099863-x64.msu

For all supported editions of Windows Server 2012 R2:
Windows8.1-KB3109094-x64.msu

For the Microsoft .NET Framework 3.5 on Windows Server 2012 R2:
Windows8.1-KB3099864-x64.msu

Installation switches

For Microsoft Windows, see Microsoft Knowledge Base Article 934307

For the Microsoft .NET Framework, see Microsoft Knowledge Base Article 2844699

Restart requirement

For Windows Server 2012 and Windows Server 2012 R2:
Yes, you must restart your system after you apply this security update.

For the Microsoft .NET Framework:
This update does not require a restart. The installer stops the required services, applies the update, and then restarts the services. However, if the required services cannot be stopped for any reason, or if required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

Removal information

For Windows Server 2012 and Windows Server 2012 R2:
To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

For the Microsoft .NET Framework:
Click Control Panel, click System and Security, and then under Windows Update, click View update history and then select from the list of updates.

File information

See Microsoft Knowledge Base Article 3109094
See Microsoft Knowledge Base Article 3099863
See Microsoft Knowledge Base Article 3099864

Registry key verification

Registry keys do not exist to validate the presence of these updates.

Deployment

The 3109094 update is available via Windows Update only.

Restart Requirement

Yes, you must restart your system after you apply this security update.

Removal Information

Click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and then select from the list of updates.

File Information

See Microsoft Knowledge Base Article 3109094

Security update file name

For all supported 32-bit editions of Windows 10:
Windows10.0-KB3116869-x86.msu

For the Microsoft .NET Framework 3.5 on all supported 32-bit editions of Windows 10:
Windows10.0-KB3116869-x86.msu

For all supported x64-based editions of Windows 10:
Windows10.0-KB3116900-x64.msu

For the Microsoft .NET Framework 3.5 on all supported x64-based editions of Windows 10:
Windows10.0-KB3116900-x64.msu

Installation switches

For Microsoft Windows, see Microsoft Knowledge Base Article 934307

For the Microsoft .NET Framework, see Microsoft Knowledge Base Article 2844699

Restart requirement

Yes, you must restart your system after you apply this security update.

Removal information

To uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.

File information

See Microsoft Knowledge Base Article 3116869
See Microsoft Knowledge Base Article 3116900

Registry key verification

Registry keys do not exist to validate the presence of these updates.

Security update file name

For Microsoft Word Viewer:
office2003-kb3114479-fullfile-enu.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Use Add or Remove Programs item in Control Panel.

File information

See Microsoft Knowledge Base Article 3114479

Registry key verification

Not applicable

Security update file name

For all supported editions of Microsoft Office 2007:
ogl2007-kb3085616-fullfile-x86-glb.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Use Add or Remove Programs item in Control Panel.

File information

See Microsoft Knowledge Base Article 3085616

Registry key verification

Not applicable

Security update file name

For all supported editions of Microsoft Office 2010 (32-bit editions):
ogl2010-kb3085612-fullfile-x86-glb.exe

For all supported editions of Microsoft Office 2010 (64-bit editions):
ogl2010-kb3085612-fullfile-x64-glb.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Use Add or Remove Programs item in Control Panel.

File information

See Microsoft Knowledge Base Article 3085612

Registry key verification

Not applicable

Security update file name

For Microsoft Live Meeting 2007 Console (3115875):
LMSetup.exe

For Microsoft Lync 2010 (32-bit) (3115871):
lync.msp

For Microsoft Lync 2010 (64-bit) (3115871):
lync.msp

For Microsoft Lync 2010 Attendee (user level install) (3115872):
AttendeeUser.msp

For Microsoft Lync 2010 Attendee (admin level install) (3115873):
AttendeeAdmin.msp

For all supported editions of Microsoft Lync 2013 (Skype for Business) (32-bit) and Microsoft Lync Basic 2013 (Skype for Business Basic) (32-bit):
lync2013-kb3114351-fullfile-x86-glb.exe

For all supported editions of Microsoft Lync 2013 (Skype for Business) (64-bit) and Microsoft Lync Basic 2013 (Skype for Business Basic) (64-bit):
lync2013-kb3114351-fullfile-x64-glb.exe

For all supported 32-bit editions of Skype for Business 2016 and Skype for Business Basic 2016:
lync2016-kb3114372-fullfile-x86-glb.exe

For all supported 64-bit editions of Skype for Business Basic 2016:
lync2016-kb3114372-fullfile-x64-glb.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal Information

Use Add or Remove Programs item in Control Panel.

File Information

For Microsoft Live Meeting 2007 Console:
See Microsoft Knowledge Base Article 3115875

For all supported editions of Microsoft Lync 2010:
See Microsoft Knowledge Base Article 3115871

For Microsoft Lync 2010 Attendee (user level install):
See Microsoft Knowledge Base Article 3115872

For Microsoft Lync 2010 Attendee (admin level install):
See Microsoft Knowledge Base Article 3115873

For Microsoft Link 2013 (Skype for Business) and Microsoft Link Basic 2013 (Skype for Business Basic):
See Microsoft Knowledge Base Article 3101496

For Skype for Business 2016 and Skype for Business Basic 2016:
See Microsoft Knowledge Base Article 3114372

Registry Key Verification

For Microsoft Live Meeting 2007 Console:
Not applicable

For Microsoft Lync 2010 (32-bit):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EEB34F6-991D-4a1b-8EEB-772DA0EADB22}
Version = 7577.4476

For Microsoft Lync 2010 (64-bit):
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0EEB34F6-991D-4a1b-8EEB-772DA0EADB22}
Version = 7577.4476

For Microsoft Lync 2010 Attendee (admin level install):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\94E53390F8C13794999249B19E6CFE33\InstallProperties\DisplayVersion = 4.0. 7577.4476

For Microsoft Lync 2010 Attendee (user level install):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0EEB34F6-991D-4a1b-8EEB-772DA0EADB22}
Version = 7577.4476

For Microsoft Lync 2013 (Skype for Business) and Microsoft Lync Basic 2013 (Skype for Business Basic):
Not applicable

For Skype for Business 2016 and Skype for Business Basic 2016:
Not applicable