MS15-116: Description of the security update for Project 2013: November 10, 2015


This security update resolves vulnerabilities in Microsoft Project 2013 that could allow remote code execution if a user opens a specially crafted Microsoft Office file. To learn more about these vulnerabilities, see Microsoft Security Bulletin MS15-116.

Note After you apply this security update, you may see a popup window that states that a website wants to open web content in protected mode in Internet Explorer. See Updates to change the way that Internet Explorer interacts with features in Microsoft Office applications for more information.

For a complete list of affected versions of Office software, see Microsoft Knowledge Base article 3104540.

Improvements and fixes

This security update contains fixes for the following nonsecurity issues:
  • After you apply status updates to project schedules, the actual work contours on some assignments unexpectedly display zero actual work values in various time periods.
  • Assume that you display the Hyperlink field in Project Professional. On a task, you enter an address in the Hyperlink field to a document that's stored on a SharePoint site, and then you click the link. Sometimes in this situation, the document doesn't open, and you're redirected to the root site where the document is stored.
  • Assume that you have a summary task that contains one or more subtasks. Then, you make the summary task become a non-summary task (either by outdenting all subtasks or by deleting all subtasks). In this scenario,the internal property on the task that specifies the duration format (minutes, hours, days, weeks, and months) may not get set correctly. Therefore, when you publish the project, the reporting data is inaccurate, and the duration of the given task isn't correct. 
  • When you use an auto filter on a text type field (such as the task name) and the values in the field are many and varied, Project 2013 may crash.
  • In some cases, a task's % Complete displays 99% even though the % Work Complete on all the assignments on the task shows 100%.
  • Saving to a SharePoint task list from Project Professional 2013 may fail when there's both an enterprise resource and a user account on the Project server that share the same name.
  • When you save a project back to a server, you receive the following error message:
    Project Web App was unable to find the specified resource.

  • After you import and merge data from an external source (for example, from an Excel workbook), only the first assignment on the task is updated.
Additionally, this security update also includes the fixes for the issues that are described in this following Microsoft Knowledge Base article:
  • 3101502 November 10, 2015, update for Project Server 2013

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Get security updates automatically.

Method 2: Microsoft Download Center

You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

More Information

Security update deployment information

For deployment information about this update, see Microsoft Knowledge Base article 3104540.


To install this security update, you must have Microsoft Project 2013 Service Pack 1 installed.

Update replacement information

This update doesn't replace a previously released update.