Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 4.6.2 Microsoft .NET Framework 4.7 Microsoft .NET Framework 4.7.1 Microsoft .NET Framework 4.7.2
IMPORTANT Verify that you have installed the required updates listed in the How to get this update section before installing this update.
IMPORTANT Some customers who use Windows Server 2008 R2 SP1 and have activated their ESU multiple activation key (MAK) add-on before installing the January 14, 2020 updates might need to re-activate their key. Re-activation on the affected devices should only be required once. For information on activation, see this blog post.
IMPORTANT WSUS scan cab files will continue to be available for Windows 7 SP1 and Windows Server 2008 R2 SP1. If you have a subset of devices running these operating systems without ESU, they might show as non-compliant in your patch management and compliance toolsets.
IMPORTANT Customers who have purchased the Extended Security Update (ESU) for on-premises versions of these operating systems must follow the procedures in KB4522133 to continue receiving security updates after extended support ends on January 14, 2020. For more information on ESU and which editions are supported, see KB4497181.
IMPORTANT Starting on January 15, 2020, a full-screen notification will appear that describes the risk of continuing to use Windows 7 Service Pack 1 after it reaches end of support on January 14, 2020. The notification will remain on the screen until you interact with it. This notification will only appear on the following editions of Windows 7 Service Pack 1:
- Home Basic.
- Home Premium.
- Professional. If you have purchased the Extended Security Update (ESU), the notification will not appear. For more information, see How to get Extended Security Updates for eligible Windows devices and Lifecycle FAQ-Extended Security Updates.
Note The notification will not appear on domain-joined machines or machines in kiosk mode.
IMPORTANT Starting in August, 2019, updates to .NET Framework 4.6 and above, for Windows Server 2008 R2 SP1, and Windows 7SP1, require SHA-2 Code signing support. Please make sure that you have all the latest Windows Updates before applying this update to avoid installation issues. For more detailed information about SHA-2 code signing support updates, please see KB 4474419.
IMPORTANT All updates for .NET Framework 4.7.2, 4.7.1, 4.7, 4.6.2, 4.6.1, and 4.6 require that the d3dcompiler_47.dll update is installed. We recommend that you install the included d3dcompiler_47.dll update before you apply this update. For more information about the d3dcompiler_47.dll, see KB 4019990.
IMPORTANT If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.
An elevation of privilege vulnerability exists when ASP.NET or .NET Framework web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update addresses the vulnerability by changing how ASP.NET and .NET Framework handle requests.
To learn more about the vulnerabilities, go to the following Common Vulnerabilities and Exposures (CVE).
Quality and reliability improvements
- Addresses rare crashes that could occur during thread abort delivery.
- Use FIPS-compliant hashes in ASP.Net telemetry data.
- Addresses an issue where "Unspecified" was not an allowed value in config for the 'cookieSameSite' attribute of the forms authentication and session state configuration sections.
- Addresses an issue where first requests to a cold site sometimes return a server configuration error from System.Web.DirectoryMonitor.AddFileMonitor().
- Addresses an issue where TextBlock reflows (makes different line-breaking decisions) during render and hit-test, vs. during measure. The symptoms include missing text, and FailFast crashes during programmatic text processing.
- Addresses a render thread failure caused by HostVisual disconnecting its target on the wrong thread.
- Addresses a hang while scrolling a TreeView whose tree is non-uniform, in the sense that a given node's children govern subtrees whose sizes are quite different.
- DataGrid's Copy command throws an exception if the system clipboard is locked by another process. This crashes, as there is usually no app code on the stack to catch the exception. The behavior of TextBox (and other apps like Notepad, Word, browsers) in this situation is to fail silently - nothing is copied to the clipboard, but no exception. A WPF app can now opt-in to this behavior by setting the following in the app.config file:
- Addresses the way non-animated text with TextRenderingMode="ClearType" and TextFormattingMode="Ideal" is drawn. It now uses a symmetric anti-aliasing algorithm, which produces better visual results for text with fine strokes (common in Far East languages, Arabic, Hebrew, and fonts designed specifically for symmetric anti-aliasing).
- Addresses a crash that can occur when closing a tooltip that is re-entrantly closed by user code.
- Addresses a memory leak in System.Speech.SpeechSynthesizer.
- Addresses issues in constructing the internal model for a FixedPage document. Some text was appearing in the wrong order for the purposes of editing operations such as selection and copy/paste.
|Net Libraries|| |
- Addresses a memory leak in HttpListener.
1 Common Language Runtime (CLR)
2 Windows Presentation Foundation (WPF)
Known issues in this update
Windows Presentation Framework (WPF) applications that use two or more HostVisual elements belonging to a common thread, where both HostVisual elements are asked to disconnect from their visual target at roughly the same time, mail fail with the following error:
Exception type: System.COMException
Message: UCEERR_RENDERTHREADFAILURE (HRESULT 0x88980406)
Callstack: top frame is System.Windows.Media.Composition.DUCE+Channel.SyncFlush()
You can disable the problematic fix by setting the AppContext switch “Switch.System.Windows.Media.HostVisual.DisconnectsOnWrongThread” to true, using one of the methods described here. This exposes your app to the original bug, so you should remove the switch once a fix is published through an upcoming update.
• Add the following entry to the app.config file to disable the problematic fix in a single application.
Note that if your application configuration already has an entry for <AppContextSwitchOverrides>, you need to add the new setting within that entry, separated from other switches by a semicolon:
<AppContextSwitchOverrides value="Switch.SomeOtherSwitch=true; Switch.System.Windows.Media.HostVisual.DisconnectsOnWrongThread=true"/>
• Apply the following registry subkey to disable the problematic fix for all WPF applications on the machine.
Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft can't guarantee that these problems can be solved. Modify the registry at your own risk.
Note that on 64-bit operating systems, you also need to apply a registry subkey with the same name, type, and value at the location: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\.NETFramework\AppContext\
We are working on a resolution and will provide an update in an upcoming release.
Additional information about this update
- 4570509 Description of the Security and Quality Rollup for .NET Framework 2.0, 3.0, 4.5.2, 4.6 for Windows Server 2008 SP2 (KB4570509)
- 4570506 Description of the Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB4570506)
How to obtain and install the update
Before installing this update
To apply this update, you must have .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 installed.
You must install the updates listed below and restart your device before installing the latest Rollup. Installing these updates improves the reliability of the update process and mitigates potential issues while installing the Rollup and applying Microsoft security fixes.
- The March 12, 2019 servicing stack update (SSU) (KB4490628). To get the standalone package for this SSU, search for it in the Microsoft Update Catalog. This update is required to install updates that are only SHA-2 signed.
- The latest SHA-2 update (KB4474419) released September 10, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically. This update is required to install updates that are only SHA-2 signed. For more information on SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
- The Extended Security Updates (ESU) Licensing Preparation Package (KB4538483) released February 11, 2020. The ESU licensing preparation package will be offered to you from WSUS. To get the standalone package for ESU licensing preparation package, search for it in the Microsoft Update Catalog.
Install this update
|Release Channel||Available||Next Step|
|Windows Update and Microsoft Update||Yes||None. This update will be downloaded and installed automatically from Windows Update if you are an ESU customer.|
|Microsoft Update Catalog||Yes||To get the standalone package for this update, go to the Microsoft Update Catalog website.|
|Windows Server Update Services (WSUS)||Yes|| |
This update will automatically sync with WSUS if you configure Products and Classifications as follows:
Product: Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1,Windows Embedded Standard 7 Service Pack 1, Windows Embedded POSReady 7Classification: Security Updates
You must restart the computer after you apply this update if any affected files are being used. We recommend that you exit all .NET Framework-based applications before you apply this update.
Update deployment information
For deployment details for this security update, go to the following article in the Microsoft Knowledge Base:
20200811 Security update deployment information: August 11, 2020
Update removal information
Note We do not recommend that you remove any security update. To remove this update, use the Programs and Features item in Control Panel.
Update restart information
This update does not require a system restart after you apply it unless files that are being updated are locked or are being used.