MS15-128: Description of the security update for Lync 2013 (Skype for Business): December 8, 2015

Applies to: Microsoft Lync 2013Skype for Business


This security update resolves vulnerabilities in Microsoft Lync 2013 and Skype for Business. The vulnerabilities could allow remote code execution if a user opens a specially crafted document or visits a webpage that contains specially crafted embedded fonts.

To learn more about the vulnerabilities, see Microsoft Security Bulletin MS15-128.

For a complete list of affected software, see Microsoft Knowledge Base article 3104503.

More Information

Known issues in this security update

  • After you install this security update, when you play back a meeting recording that you made in Skype for Business 2015, the video track is missing although the audio track remains intact. For more information about how to resolve this issue, click the following article number to view the article in the Microsoft Knowledge Base:
    3128747 Video is missing in a Skype for Business 2015 meeting recording after the December 2015 security update 3114351 is installed

How to obtain and install the update

Method 1: Microsoft Update

This update is available through Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Get security updates automatically.

Method 2: Microsoft Download Center

You can obtain the stand-alone update package through the Microsoft Download Center. To install the update, follow the installation instructions on the download page.


  • After you apply this update, Lync 2013 will be upgraded to Skype for Business. Learn about the new experience in Skype for Business.
  • You can still use the Lync client user interface after you apply this update for Lync 2013 (Skype for Business).
  • You can obtain general information about how to switch between the Skype for Business and the Lync client user interfaces for Microsoft Office 365 users and Lync Server 2013 users.

More Information

Update deployment information

For deployment information about this update, see Microsoft Knowledge Base article 3104503.


To install this security update, you must first have the following updates installed.

Update replacement information

This security update replaces previously released security update 3101496.

File Information

The global version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.