Security and Quality Rollup for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 SP1 and Server 2008 R2 SP1 and Server 2008 (KB4506997)

Applies to:

Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 4.6.2 Microsoft .NET Framework 4.7 Microsoft .NET Framework 4.7.1 Microsoft .NET Framework 4.7.2

Summary

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file. An Authentication Bypass vulnerability exists in WCF and WIF, allowing signing of SAML tokens with arbitrary symmetric keys. This vulnerability allows an attacker to impersonate another user. The vulnerability exists in WCF, WIF 3.5 and above in .NET Framework, WIF 1.0 component in Windows, WIF Nuget package, and WIF implementation in Sharepoint. An information disclosure vulnerability exists when Exchange and Azure Active Directory allow creation of entities with Display Names having non-printable characters.

To learn more about the vulnerabilities, go to the following Common Vulnerabilities and Exposures (CVE).

Important

All updates for .NET Framework 4.7.2, 4.7.1, 4.7, 4.6.2, 4.6.1, and 4.6 require that the d3dcompiler_47.dll update is installed. We recommend that you install the included d3dcompiler_47.dll update before you apply this update. For more information about the d3dcompiler_47.dll, see KB 4019990.
If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

Additional information about this update

The following articles contain additional information about this update as it relates to individual product versions.

4507423 Description of the Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.5.2, 4.6 for Windows Server 2008 SP2 (KB4507423)
4507420 Description of the Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Server 2008 R2 SP1 (KB4507420)

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog.

Method 3: Windows Software Update Services (WSUS)

On your WSUS server, follow these steps:

Select Start, select Administrative Tools, and then select Microsoft Windows Server Update Services 3.0.
Expand ComputerName, and then select Action.
Select Import Updates.
WSUS opens a browser window in which you may be prompted to install an ActiveX control. You must install the ActiveX control to continue.
After the ActiveX control is installed, you see the Microsoft Update Catalog screen. Type 4507420 for Windows 7 SP1 and Server 2008 R2 SP1 or type 4507423 for Windows Server 2008 SP2 into the Search box, and then select Search.
Locate the .NET Framework packages that match the operating systems, languages, and processors in your environment. Select Add to add them to your basket.
After you select all the packages that you require, select View Basket.
To import the packages to your WSUS server, select Import.
After the packages are imported, select Close to return to WSUS.

The updates are now available for installation through WSUS.

Update deployment information

For deployment details for this security update, go to the following article in the Microsoft Knowledge Base:

20190709 Security update deployment information: July 9, 2019

Update removal information

Note We do not recommend that you remove any security update. To remove this update, use the Programs and Features item in Control Panel.

Update restart information

This update does not require a system restart after you apply it unless files that are being updated are locked or are being used.

Update replacement information

This update replaces previously released updates 4499406 and 4503865 for Windows 7 SP1 and Server 2008 R2 SP1 and 4499409 and 4503868 for Windows Server 2008 SP2.

File information
The English (United States) version of this software update installs files that have the attributes that are listed in the following tables.

File information

File hash information

File name	SHA1 hash	SHA256 hash
NDP47-KB4506997-x86.exe	8A98345CFB7B95BE30CF087FBDB09A79683812FD	332EB708146EB71CDEE44A67577B0382634182C35840E68E938B53B2605FDB12
NDP47-KB4506997-x64.exe	4372AEB322DE0738C2BCAC582D9D19B15A93FABF	9E31B9969EAA5720FB78FD5208D1FB262DE48D1DA78FB1F1EF69C1B6380599F8

For all supported x86-based versions

File name	File version	File size	Date	Time
Aspnet_perf.dll	4.7.3429.0	42,544	04-Jun-2019	02:09
aspnet_wp.exe	4.7.3429.0	46,144	04-Jun-2019	02:09
clr.dll	4.7.3416.0	7,249,456	04-Jun-2019	02:09
clrjit.dll	4.7.3416.0	522,800	04-Jun-2019	02:09
dfdll.dll	4.7.3221.0	159,952	04-Jun-2019	02:09
GlobalUserInterface.CompositeFont		186,009	04-Jun-2019	02:09
mscordacwks.dll	4.7.3416.0	1,343,016	04-Jun-2019	02:09
mscordbi.dll	4.7.3416.0	1,168,936	04-Jun-2019	02:09
mscoreei.dll	4.7.3221.0	511,712	04-Jun-2019	02:09
mscorlib.dll	4.7.3416.0	5,645,360	04-Jun-2019	02:09
msvcp120_clr0400.dll	12.0.52519.0	485,576	04-Jun-2019	02:13
msvcr120_clr0400.dll	12.0.52519.0	987,840	04-Jun-2019	02:13
VsVersion.dll	14.7.3429.0	18,984	04-Jun-2019	02:09
peverify.dll	4.7.3416.0	188,696	04-Jun-2019	02:09
PresentationCore.dll	4.7.3429.0	3,636,272	04-Jun-2019	02:09
PresentationFramework.dll	4.7.3429.0	6,237,232	04-Jun-2019	02:09
PresentationFramework-SystemData.dll	4.7.3429.0	24,112	04-Jun-2019	02:09
PresentationHost_v0400.dll	4.7.3429.0	214,056	04-Jun-2019	02:09
PresentationHost_v0400.dll.mui	4.7.3429.0	84,528	04-Jun-2019	02:09
PresentationNative_v0400.dll	4.7.3429.0	826,920	04-Jun-2019	02:09
ServiceMonikerSupport.dll	4.7.3440.0	29,232	04-Jun-2019	02:13
SMDiagnostics.dll	4.7.3440.0	73,632	04-Jun-2019	02:12
SOS.dll	4.7.3416.0	743,688	04-Jun-2019	02:09
System.Activities.dll	4.7.3440.0	1,532,832	04-Jun-2019	02:12
System.ComponentModel.DataAnnotations.dll	4.7.3221.0	127,400	04-Jun-2019	02:09
System.Core.dll	4.7.3429.0	1,551,768	04-Jun-2019	02:09
System.Data.Entity.dll	4.7.3221.0	4,035,664	04-Jun-2019	02:09
System.DirectoryServices.AccountManagement.dll	4.7.3221.0	297,648	04-Jun-2019	02:09
System.IdentityModel.dll	4.7.3440.0	1,094,560	04-Jun-2019	02:12
System.IdentityModel.Services.dll	4.7.3440.0	198,192	04-Jun-2019	02:13
System.Runtime.Serialization.dll	4.7.3440.0	1,056,160	04-Jun-2019	02:12
System.ServiceModel.Channels.dll	4.7.3440.0	157,744	04-Jun-2019	02:12
System.ServiceModel.Discovery.dll	4.7.3440.0	308,272	04-Jun-2019	02:12
System.ServiceModel.dll	4.7.3440.0	6,322,080	04-Jun-2019	02:12
System.ServiceModel.Internals.dll	4.7.3440.0	260,512	04-Jun-2019	02:12
System.ServiceModel.Routing.dll	4.7.3221.0	132,208	04-Jun-2019	02:09
System.ServiceModel.WasHosting.dll	4.7.3440.0	39,984	04-Jun-2019	02:13
System.Web.ApplicationServices.dll	4.7.3429.0	70,560	04-Jun-2019	02:09
System.Web.Extensions.dll	4.7.3429.0	1,849,752	04-Jun-2019	02:09
System.Workflow.Activities.dll	4.7.3440.0	1,051,184	04-Jun-2019	02:13
System.Workflow.ComponentModel.dll	4.7.3440.0	1,552,432	04-Jun-2019	02:13
System.Workflow.Runtime.dll	4.7.3440.0	498,736	04-Jun-2019	02:13
System.Runtime.Caching.dll	4.7.3221.0	109,864	04-Jun-2019	02:09
System.Configuration.dll	4.7.3324.0	419,648	04-Jun-2019	02:09
System.Data.dll	4.7.3260.0	3,462,912	04-Jun-2019	02:09
System.Data.SqlXml.dll	4.7.3221.0	734,520	04-Jun-2019	02:09
System.Deployment.dll	4.7.3221.0	879,408	04-Jun-2019	02:09
System.DirectoryServices.Protocols.dll	4.7.3221.0	201,624	04-Jun-2019	02:09
System.dll	4.7.3416.0	3,562,312	04-Jun-2019	02:09
System.Drawing.dll	4.7.3221.0	600,864	04-Jun-2019	02:09
System.Management.dll	4.7.3221.0	415,536	04-Jun-2019	02:09
System.Net.Http.dll	4.7.3221.0	204,584	04-Jun-2019	02:09
System.Runtime.Remoting.dll	4.7.3221.0	347,472	04-Jun-2019	02:09
System.Security.dll	4.7.3221.0	325,928	04-Jun-2019	02:09
System.Transactions.dll	4.7.3221.0	309,328	04-Jun-2019	02:09
System.Web.dll	4.7.3429.0	5,415,984	04-Jun-2019	02:09
System.Windows.Controls.Ribbon.dll	4.7.3429.0	742,448	04-Jun-2019	02:09
System.Windows.Forms.dll	4.7.3324.0	5,236,640	04-Jun-2019	02:09
System.Xaml.dll	4.7.3429.0	641,952	04-Jun-2019	02:09
System.Xml.dll	4.7.3221.0	2,670,344	04-Jun-2019	02:09
UIAutomationClient.dll	4.7.3429.0	177,712	04-Jun-2019	02:09
UIAutomationClientsideProviders.dll	4.7.3429.0	361,000	04-Jun-2019	02:09
UIAutomationProvider.dll	4.7.3429.0	48,688	04-Jun-2019	02:09
UIAutomationTypes.dll	4.7.3429.0	220,720	04-Jun-2019	02:09
webengine.dll	4.7.3429.0	24,624	04-Jun-2019	02:09
webengine4.dll	4.7.3429.0	550,144	04-Jun-2019	02:09
WindowsBase.dll	4.7.3429.0	1,295,912	04-Jun-2019	02:09
WMINet_Utils.dll	4.7.3221.0	136,432	04-Jun-2019	02:09
WorkflowServiceHostPerformanceCounters.dll	4.7.3440.0	89,136	04-Jun-2019	02:12
WPFFontCache_v0400.exe.mui	4.7.3429.0	18,992	04-Jun-2019	02:09
WPFFontCache_v0400.exe	4.7.3429.0	25,696	04-Jun-2019	02:09
wpfgfx_v0400.dll	4.7.3429.0	1,345,072	04-Jun-2019	02:09
Placeholder.dll	4.7.3429.0	24,624	04-Jun-2019	02:09
PenIMC2_v0400.dll	4.7.3429.0	86,064	04-Jun-2019	02:09

For all supported x64-based versions

File name	File version	File size	Date	Time
Aspnet_perf.dll	4.7.3429.0	46,128	04-Jun-2019	02:09
Aspnet_perf.dll	4.7.3429.0	42,544	04-Jun-2019	02:09
aspnet_wp.exe	4.7.3429.0	50,744	04-Jun-2019	02:09
aspnet_wp.exe	4.7.3429.0	46,144	04-Jun-2019	02:09
clr.dll	4.7.3416.0	10,377,776	04-Jun-2019	02:09
clr.dll	4.7.3416.0	7,249,456	04-Jun-2019	02:09
clrjit.dll	4.7.3416.0	1,221,680	04-Jun-2019	02:09
clrjit.dll	4.7.3416.0	522,800	04-Jun-2019	02:09
compatjit.dll	4.7.3416.0	1,259,568	04-Jun-2019	02:09
dfdll.dll	4.7.3221.0	191,696	04-Jun-2019	02:09
dfdll.dll	4.7.3221.0	159,952	04-Jun-2019	02:09
GlobalUserInterface.CompositeFont		186,009	04-Jun-2019	02:09
mscordacwks.dll	4.7.3416.0	1,840,176	04-Jun-2019	02:09
mscordacwks.dll	4.7.3416.0	1,343,016	04-Jun-2019	02:09
mscordbi.dll	4.7.3416.0	1,622,064	04-Jun-2019	02:09
mscordbi.dll	4.7.3416.0	1,168,936	04-Jun-2019	02:09
mscoreei.dll	4.7.3221.0	630,496	04-Jun-2019	02:09
mscoreei.dll	4.7.3221.0	511,712	04-Jun-2019	02:09
mscorlib.dll	4.7.3416.0	5,427,248	04-Jun-2019	02:09
mscorlib.dll	4.7.3416.0	5,645,360	04-Jun-2019	02:09
msvcp120_clr0400.dll	12.0.52519.0	690,008	04-Jun-2019	02:33
msvcp120_clr0400.dll	12.0.52519.0	485,576	04-Jun-2019	02:13
msvcr120_clr0400.dll	12.0.52519.0	993,632	04-Jun-2019	02:33
msvcr120_clr0400.dll	12.0.52519.0	987,840	04-Jun-2019	02:13
VsVersion.dll	14.7.3429.0	18,992	04-Jun-2019	02:09
VsVersion.dll	14.7.3429.0	18,984	04-Jun-2019	02:09
peverify.dll	4.7.3416.0	260,144	04-Jun-2019	02:09
peverify.dll	4.7.3416.0	188,696	04-Jun-2019	02:09
PresentationCore.dll	4.7.3429.0	3,613,744	04-Jun-2019	02:09
PresentationCore.dll	4.7.3429.0	3,636,272	04-Jun-2019	02:09
PresentationFramework.dll	4.7.3429.0	6,237,232	04-Jun-2019	02:09
PresentationFramework-SystemData.dll	4.7.3429.0	24,112	04-Jun-2019	02:09
PresentationHost_v0400.dll	4.7.3429.0	277,552	04-Jun-2019	02:09
PresentationHost_v0400.dll.mui	4.7.3429.0	84,528	04-Jun-2019	02:09
PresentationHost_v0400.dll	4.7.3429.0	214,056	04-Jun-2019	02:09
PresentationHost_v0400.dll.mui	4.7.3429.0	84,528	04-Jun-2019	02:09
PresentationNative_v0400.dll	4.7.3429.0	1,109,552	04-Jun-2019	02:09
PresentationNative_v0400.dll	4.7.3429.0	826,920	04-Jun-2019	02:09
ServiceMonikerSupport.dll	4.7.3440.0	31,272	04-Jun-2019	02:33
ServiceMonikerSupport.dll	4.7.3440.0	29,232	04-Jun-2019	02:13
SMDiagnostics.dll	4.7.3440.0	73,632	04-Jun-2019	02:12
SOS.dll	4.7.3416.0	871,984	04-Jun-2019	02:09
SOS.dll	4.7.3416.0	743,688	04-Jun-2019	02:09
System.Activities.dll	4.7.3440.0	1,532,832	04-Jun-2019	02:12
System.ComponentModel.DataAnnotations.dll	4.7.3221.0	127,400	04-Jun-2019	02:09
System.Core.dll	4.7.3429.0	1,551,768	04-Jun-2019	02:09
System.Data.Entity.dll	4.7.3221.0	4,035,664	04-Jun-2019	02:09
System.DirectoryServices.AccountManagement.dll	4.7.3221.0	297,648	04-Jun-2019	02:09
System.IdentityModel.dll	4.7.3440.0	1,094,560	04-Jun-2019	02:12
System.IdentityModel.Services.dll	4.7.3440.0	198,192	04-Jun-2019	02:13
System.Runtime.Serialization.dll	4.7.3440.0	1,056,160	04-Jun-2019	02:12
System.ServiceModel.Channels.dll	4.7.3440.0	157,744	04-Jun-2019	02:12
System.ServiceModel.Discovery.dll	4.7.3440.0	308,272	04-Jun-2019	02:12
System.ServiceModel.dll	4.7.3440.0	6,322,080	04-Jun-2019	02:12
System.ServiceModel.Internals.dll	4.7.3440.0	260,512	04-Jun-2019	02:12
System.ServiceModel.Routing.dll	4.7.3221.0	132,208	04-Jun-2019	02:09
System.ServiceModel.WasHosting.dll	4.7.3440.0	39,984	04-Jun-2019	02:13
System.Web.ApplicationServices.dll	4.7.3429.0	70,560	04-Jun-2019	02:09
System.Web.Extensions.dll	4.7.3429.0	1,849,752	04-Jun-2019	02:09
System.Workflow.Activities.dll	4.7.3440.0	1,051,184	04-Jun-2019	02:13
System.Workflow.ComponentModel.dll	4.7.3440.0	1,552,432	04-Jun-2019	02:13
System.Workflow.Runtime.dll	4.7.3440.0	498,736	04-Jun-2019	02:13
System.Runtime.Caching.dll	4.7.3221.0	109,864	04-Jun-2019	02:09
System.configuration.dll	4.7.3324.0	419,648	04-Jun-2019	02:09
System.Data.dll	4.7.3260.0	3,524,864	04-Jun-2019	02:09
System.Data.dll	4.7.3260.0	3,462,912	04-Jun-2019	02:09
System.Data.SqlXml.dll	4.7.3221.0	734,520	04-Jun-2019	02:09
System.Deployment.dll	4.7.3221.0	879,408	04-Jun-2019	02:09
System.DirectoryServices.Protocols.dll	4.7.3221.0	201,624	04-Jun-2019	02:09
System.dll	4.7.3416.0	3,562,312	04-Jun-2019	02:09
System.Drawing.dll	4.7.3221.0	600,864	04-Jun-2019	02:09
System.Management.dll	4.7.3221.0	415,536	04-Jun-2019	02:09
System.Net.Http.dll	4.7.3221.0	204,584	04-Jun-2019	02:09
System.Runtime.Remoting.dll	4.7.3221.0	347,472	04-Jun-2019	02:09
System.Security.dll	4.7.3221.0	325,928	04-Jun-2019	02:09
System.Transactions.dll	4.7.3221.0	311,048	04-Jun-2019	02:09
System.Transactions.dll	4.7.3221.0	309,328	04-Jun-2019	02:09
System.Web.dll	4.7.3429.0	5,397,552	04-Jun-2019	02:09
System.Web.dll	4.7.3429.0	5,415,984	04-Jun-2019	02:09
System.Windows.Controls.Ribbon.dll	4.7.3429.0	742,448	04-Jun-2019	02:09
System.Windows.Forms.dll	4.7.3324.0	5,236,640	04-Jun-2019	02:09
System.Xaml.dll	4.7.3429.0	641,952	04-Jun-2019	02:09
System.XML.dll	4.7.3221.0	2,670,344	04-Jun-2019	02:09
UIAutomationClient.dll	4.7.3429.0	177,712	04-Jun-2019	02:09
UIAutomationClientsideProviders.dll	4.7.3429.0	361,000	04-Jun-2019	02:09
UIAutomationProvider.dll	4.7.3429.0	48,688	04-Jun-2019	02:09
UIAutomationTypes.dll	4.7.3429.0	220,720	04-Jun-2019	02:09
webengine.dll	4.7.3429.0	26,160	04-Jun-2019	02:09
webengine.dll	4.7.3429.0	24,624	04-Jun-2019	02:09
webengine4.dll	4.7.3429.0	667,184	04-Jun-2019	02:09
webengine4.dll	4.7.3429.0	550,144	04-Jun-2019	02:09
WindowsBase.dll	4.7.3429.0	1,295,912	04-Jun-2019	02:09
WMINet_Utils.dll	4.7.3221.0	188,144	04-Jun-2019	02:09
WMINet_Utils.dll	4.7.3221.0	136,432	04-Jun-2019	02:09
WorkflowServiceHostPerformanceCounters.dll	4.7.3440.0	101,144	04-Jun-2019	02:33
WorkflowServiceHostPerformanceCounters.dll	4.7.3440.0	89,136	04-Jun-2019	02:12
WPFFontCache_v0400.exe.mui	4.7.3429.0	19,208	04-Jun-2019	02:09
WPFFontCache_v0400.exe.mui	4.7.3429.0	18,992	04-Jun-2019	02:09
WPFFontCache_v0400.exe	4.7.3429.0	26,720	04-Jun-2019	02:09
WPFFontCache_v0400.exe	4.7.3429.0	25,696	04-Jun-2019	02:09
wpfgfx_v0400.dll	4.7.3429.0	1,764,400	04-Jun-2019	02:09
wpfgfx_v0400.dll	4.7.3429.0	1,345,072	04-Jun-2019	02:09
Placeholder.dll	4.7.3429.0	25,648	04-Jun-2019	02:09
Placeholder.dll	4.7.3429.0	24,624	04-Jun-2019	02:09
PenIMC2_v0400.dll	4.7.3429.0	104,496	04-Jun-2019	02:09
PenIMC2_v0400.dll	4.7.3429.0	86,064	04-Jun-2019	02:09

Information about protection and security

Protect yourself online: Windows Security support
Learn how we guard against cyber threats: Microsoft Security