MS16-004: Security Update for Microsoft Office to Address Remote Code Execution: January 12, 2016

Summary

This security update resolves a vulnerability in Microsoft Office. To learn more about the vulnerability, see Microsoft Security Bulletin MS16-004.

More information about this security update

The following articles contain more information about this security update as it relates to individual product versions. These articles may contain known issue information.

  • 2881029 MS16-004: Description of the security update for Office 2010: January 12, 2016

  • 2881067 MS16-004: Description of the security update for the 2007 Microsoft Office Suite: January 12, 2016

  • 2920727 MS16-004: Description of the security update for Office 2016: January 12, 2016

  • 3039794 MS16-004: Description of the security update for Office 2013: January 12, 2016

  • 3096896 MS16-004: Description of the security update for Microsoft Visual Basic Runtime 6.0: January 12, 2016

  • 3114396 MS16-004: Description of the security update for PowerPoint 2010: January 12, 2016

  • 3114402 MS16-004: Description of the security update for Visio 2010: January 12, 2016

  • 3114421 MS16-004: Description of the security update for Visio 2007: January 12, 2016

  • 3114429 MS16-004: Description of the security update for PowerPoint 2007: January 12, 2016

  • 3114482 MS16-004: Description of the security update for PowerPoint 2013: January 12, 2016

  • 3114486 MS16-004: Description of the security update for Office 2013: January 12, 2016

  • 3114489 MS16-004: Description of the security update for Visio 2013: January 12, 2016

  • 3114494 MS16-004: Description of the security update for Word 2013: January 12, 2016

  • 3114503 MS16-004: Description of the security update for SharePoint Foundation 2013: January 12, 2016

  • 3114504 MS16-004: Description of the security update for Excel 2013: January 12, 2016

  • 3114511 MS16-004: Description of the security update for Visio 2016: January 12, 2016

  • 3114518 MS16-004: Description of the security update for PowerPoint 2016: January 12, 2016

  • 3114520 MS16-004: Description of the security update for Excel 2016: January 12, 2016

  • 3114526 MS16-004: Description of the security update for Word 2016: January 12, 2016

  • 3114527 MS16-004: Description of the security update for Office 2016: January 12, 2016

  • 3114540 MS16-004: Description of the security update for Excel 2007: January 12, 2016

  • 3114541 MS16-004: Description of the security update for the 2007 Microsoft Office Suite: January 12, 2016

  • 3114546 MS16-004: Description of the security update for Office Compatibility Pack Service Pack 3: January 12, 2016

  • 3114547 MS16-004: Description of the security update for Excel Viewer 2007: January 12, 2016

  • 3114549 MS16-004: Description of the security update for Word 2007: January 12, 2016

  • 3114553 MS16-004: Description of the security update for Office 2010: January 12, 2016

  • 3114554 MS16-004: Description of the security update for Office 2010: January 12, 2016

  • 3114557 MS16-004: Description of the security update for Word 2010: January 12, 2016

  • 3114564 MS16-004: Description of the security update for Excel 2010: January 12, 2016

  • 3114569 MS16-004: Description of the security update for Word Viewer: January 12, 2016

  • 3133699 MS16-004: Description of the security update for Office for Mac 2011: January 12, 2016

  • 3133711 MS16-004: Description of the security update for Office 2016 for Mac: January 12, 2016

Known issues in this security update

  • After you apply security update 2881067, 2881029, 3039794, or 2920727, you have problems that affect your Access database if you use certain Windows common controls. Specifically, these problems occur if you use the controls that are associated with the MSCOMCTL.OCX file that's updated in the security update. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

    3139567 Error messages or Access crashes after you install security update MS16-004

Nonsecurity-related fixes and improvements that are included in this security update

  • Improves grid display performance when you enter data and formulas in the presence of split or freeze panes in Excel 2013.

  • Adds a function to set the SPWeb.RequestAccessEmail property by using a client-side object model (CSOM).

  • Translates some terms in multiple languages to make sure that the meaning is accurate.

  • Contains fixes for the following nonsecurity issues:

    • The Font.TintAndShade property doesn't work in Excel object model.

    • When you try to close a workbook that's opened by a modal userform, the workbook that contains the macro and the userform is closed unexpectedly.

    • When you check permissions, incorrect permissions are reported based on group memberships across trusted domain boundaries. Therefore, an external token isn't populated with security groups of trusted domains.

    • If a SQL Server Report Viewer Web Part is created before Service Pack 1 was applied, a page that contains the Report Viewer Web Part can't be loaded, and you receive the following error message:

      You must first select a report to display in this Web Part. Do this by opening the tool pane and specifying the path and file name of the Reporting Services report that you would like to show. Alternatively, you can connect the Web Part to another Web Part on the page that provides a document path.

    • After you create a view on a publishing sub site, the view is displayed in datasheet view. Meanwhile, you receive the following error message:

      The list is displayed in Standard view. It cannot be displayed in Datasheet view for one or more of the following reasons: A datasheet component compatible with Microsoft SharePoint Foundation is not installed, your browser does not support ActiveX controls, a component is not properly configured for 32-bit or 64-bit support, or support for ActiveX controls is disabled.

    • When you click the Save button multiple times on the ribbon to add an item to a list, the item is added multiple times.

    • When you try to update the configuration database for the host-named site collections by using the SPContentDatabase.RefreshSitesInConfigurationDatabase method, the sites become unavailable if the site collections are set in content databases that are separate from the root site collection.

    • Assume that you have a site collection that has the document ID feature enabled or a URL field that points to a resource within the site collection. Then, you check out a document and move the content database of the site collection to another web application. After you check in the document, the URL of the document points to the old site.

    • When you try to insert an HTML file as an object in a Word 2013 document, you receive the following error message:

      The program used to create this object is html file. That program is either not installed on your computer or it is not responding. To edit this object, install html file or ensure that any dialog boxes in html file are closed.

    • If the default input language is set to a language that uses Cyrillic characters, some keyboard shortcuts (for example, Ctrl+C and Ctrl+V) do not work in Word 2013.

    • A Universal Naming Convention (UNC) path that contains some full-width characters isn't resolved as a hyperlink in Word 2013.

    • It takes longer than expected to update the custom XML in the XML Mapping pane in Word 2013.

    • After you save a Visio drawing that contains ActiveX controls and VBA macros in Visio 2013, the digital signature is lost.

    • When you click a hyperlink in a Visio document that's located on a SharePoint 2013 server, the linked file doesn't open. This issue occurs if the name of the linked file contains characters that are not in the Latin character set (for example, Cyrillic letters).

    • After you use the Office deployment tool to install Office 2013 Click-to-Run editions that have multiple language packs, the language that is set in the config.xml as the first language isn't set as the default language.

    • After you save an Excel workbook that contains an unregistered ActiveX control in Excel 2013, Excel 2013 crashes.

    • When you try to open a file that's encrypted by a custom encryption provider in an Office 2013 application, the application crashes.

    • Assume that you delete a cell comment of a cell that has a fill effect in a workbook in Excel 2013. Then, you save the workbook. When you reopen the file, you receive the following error message:

      Excel found unreadable content in 'workbookname.xlsx'. Do you want to recover the contents of this workbook? If you trust the source of this workbook, click Yes.

      After you select the Yes button, you receive the following error message:

      Excel was able to open the file by repairing or removing the unreadable content.

    • After you install the November 10, 2015 update for Office 2013 (KB3101360) or the December 8, 2015 update for Office 2013 (KB3114333), Office applications may hang or crash. This may affect one or more Office applications, such as Outlook 2013, Word 2013, Excel 2013, OneNote 2013, and PowerPoint 2013.

    • When you try to use PowerPoint 2013 to open a presentation in SharePoint Server in protected mode in Internet Explorer, you receive the following error message:

      Sorry, we couldn't find C:\users\<userid>\Desktop\%u. Is it possible it was moved, renamed, or deleted?

    • Assume that you create a bookmark for more than one paragraph in an email message in Outlook 2016. Then, you send the email message. When you check the bookmark of the message, an incorrect selection is displayed.

    • You can't save a document to a document library that has a required column in Word 2016.

    • When you use a Japanese input method editor in Word 2016, you experience the following issues:

      • Certain special characters, such as circled numbers, aren't displayed correctly.

      • Backspace and delete operations do not work.

      • Selecting an item from a candidate list doesn't work.

    • When you use certain fonts to enter a nonbreaking hyphen in a document in Word 2016, a square is displayed instead of a nonbreaking hyphen.

    • It takes a long time to clear a column filter for a large workbook in Excel 2016 on a Windows 10-based computer.

    • When you print or print preview a worksheet in Excel 2016, the name of a group box (form control) is displayed in an incorrect position.

    • Sometimes you receive an out-of-memory error when you create a new Excel window after you use an Excel preview window in Outlook.

    • Assume that you create a workbook that contains a new type chart (a treemap, sunburst, histogram, box and whisker, Pareto, or waterfall chart) in an installation of Excel 2016 that has security update 3101351 installed. Then, you change the workbook in Excel 2016 RTM. When you reopen the workbook in Excel 2016, the chart is disconnected from the data source.

    • When you try to use PowerPoint 2016 to open a presentation in SharePoint Server in protected mode in Internet Explorer, you receive the following error message:

      Sorry, we couldn't find C:\users\<userid>\Desktop\%u. Is it possible it was moved, renamed, or deleted?


More Information

Microsoft Office 2007 (all editions) and Other SoftwareReference Table

The following table contains the security update information for this software.

Security update file name

For Microsoft Office 2007 Service Pack 3:
mscomctlocx2007-kb2881067-fullfile-x86-glb.exe
For Microsoft Office 2007 Service Pack 3:
mso2007-kb3114541-fullfile-x86-glb.exe

For Microsoft Excel 2007 Service Pack 3:
excel2007-kb3114540-fullfile-x86-glb.exe

For Microsoft PowerPoint 2007 Service Pack 3:
powerpoint2007-kb3114429-fullfile-x86-glb.exe

For Microsoft Visio 2007 Service Pack 3:
visio2007-kb3114421-fullfile-x86-glb.exe

For Microsoft Word 2007 Service Pack 3:
word2007-kb3114549-fullfile-x86-glb.exe

For Microsoft Office Compatibility Pack:
xlconv2007-kb3114546-fullfile-x86-glb.exe

For Microsoft Excel Viewer:
xlview2007-kb3114547-fullfile-x86-glb.exe

For Microsoft Word Viewer:
office-kb3114569-fullfile-enu.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Use Add or Remove Programs item in Control Panel.

File information

See Microsoft Knowledge Base Article 2881067
See Microsoft Knowledge Base Article 3114421
See Microsoft Knowledge Base Article 3114429
See Microsoft Knowledge Base Article 3114540
See Microsoft Knowledge Base Article 3114541
See Microsoft Knowledge Base Article 3114546
See Microsoft Knowledge Base Article 3114547
See Microsoft Knowledge Base Article 3114549
See Microsoft Knowledge Base Article 3114569

Registry key verification

Not applicable

Microsoft Office 2010 (all editions)Reference Table

The following table contains the security update information for this software.

Security update file name

For Microsoft Office 2010 Service Pack 2 (32-bit editions)
mscomctlocx2010-kb2881029-fullfile-x86-glb.exe

For Microsoft Office 2010 Service Pack 2 (32-bit editions)
mso2010-kb3114553-fullfile-x86-glb.exe

For Microsoft Office 2010 Service Pack 2 (64-bit editions)
mso2010-kb3114553-fullfile-x64-glb.exe

For Microsoft Office 2010 Service Pack 2 (32-bit editions)
kb24286772010-kb3114554-fullfile-x86-glb.exe

For Microsoft Office 2010 Service Pack 2 (64-bit editions)
kb24286772010-kb3114554-fullfile-x64-glb.exe

For Microsoft Excel 2010 Service Pack 2 (32-bit editions)
excel2010-kb3114564-fullfile-x86-glb.exe

For Microsoft Excel 2010 Service Pack 2 (64-bit editions)
excel2010-kb3114564-fullfile-x64-glb.exe

For Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)
powerpoint2010-kb3114396-fullfile-x86-glb.exe

For Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)
powerpoint2010-kb3114396-fullfile-x64-glb.exe

For Microsoft Visio 2010 Service Pack 2 (32-bit editions):
visio2010-kb3114402-fullfile-x86-glb.exe

For Microsoft Visio 2010 Service Pack 2 (64-bit editions):
visio2010-kb3114402-fullfile-x64-glb.exe

For Microsoft Word 2010 Service Pack 2 (32-bit editions):
word2010-kb3114557-fullfile-x86-glb.exe

For Microsoft Word 2010 Service Pack 2 (64-bit editions):
word2010-kb3114557-fullfile-x64-glb.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Use Add or Remove Programs item in Control Panel.

File information

See Microsoft Knowledge Base Article 2881029
See Microsoft Knowledge Base Article 3114396
See Microsoft Knowledge Base Article 3114402
See Microsoft Knowledge Base Article 3114553
See Microsoft Knowledge Base Article 3114554
See Microsoft Knowledge Base Article 3114557
See Microsoft Knowledge Base Article 3114564

Registry key verification

Not applicable

Microsoft Office 2013 (all editions)Reference Table

The following table contains the security update information for this software.

Security update file name

For supported editions of Microsoft Office 2013 (32-bit editions):
mscomctlocx2013-kb3039794-fullfile-x86-glb.exe

For supported editions of Microsoft Office 2013 (32-bit editions):
mso2013-kb3114486-fullfile-x86-glb.exe

For supported editions of Microsoft Office 2013 (64-bit editions):
mso2013-kb3114486-fullfile-x64-glb.exe

For supported editions of Microsoft Excel 2013 (32-bit editions):
excel2013-kb3114504-fullfile-x86-glb.exe

For supported editions of Microsoft Excel 2013 (64-bit editions):
excel2013-kb3114504-fullfile-x64-glb.exe

For supported editions of Microsoft PowerPoint 2013 (32-bit editions):
powerpoint2013-kb3114482-fullfile-x86-glb.exe

For supported editions of Microsoft PowerPoint 2013 (64-bit editions):
powerpoint2013-kb3114482-fullfile-x64-glb.exe

For supported editions of Microsoft Visio 2013 (32-bit editions):
visio2013-kb3114489-fullfile-x86-glb.exe

For supported editions of Microsoft Word 2013 Service Pack 1 (32-bit editions):
word2013-kb3114494-fullfile-x86-glb.exe

For supported editions of Microsoft Word 2013 Service Pack 1 (64-bit editions):
word2013-kb3114494-fullfile-x64-glb.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Use Add or Remove Programs item in Control Panel.

File information

See Microsoft Knowledge Base Article 3039794
See Microsoft Knowledge Base Article 3114482
See Microsoft Knowledge Base Article 3114486
See Microsoft Knowledge Base Article 3114489
See Microsoft Knowledge Base Article 3114494
See Microsoft Knowledge Base Article 3114504

Registry key verification

Not applicable

Microsoft Office 2013 RT (all editions)Reference Table

The following table contains the security update information for this software.

Deployment

The 3114486 update for Microsoft Office 2013 RT is available via Windows Update.

The 3114504 update for Microsoft Excel 2013 RT is available via Windows Update.

The 3114482 update for Microsoft PowerPoint 2013 RT is available via Windows Update.

The 3114494 update for Microsoft Word 2013 RT is available via Windows Update.

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.

File information

See Microsoft Knowledge Base Article 3114482
See Microsoft Knowledge Base Article 3114486
See Microsoft Knowledge Base Article 3114494
See Microsoft Knowledge Base Article 3114504

Microsoft Office 2016 (all editions)Reference Table

The following table contains the security update information for this software.

Security update file name

For Microsoft Office 2016 (32-bit edition):
mscomctlocx2016-kb2920727-fullfile-x86-glb.exe

For Microsoft Office 2016 (32-bit edition):
mso2016-kb3114527-fullfile-x86-glb.exe

For Microsoft Office 2016 (64-bit edition):
mso2016-kb3114527-fullfile-x64-glb.exe

For Microsoft Excel 2016 (32-bit edition):
excel2016-kb3114520-fullfile-x86-glb.exe

For Microsoft Excel 2016 (64-bit edition):
excel2016-kb3114520-fullfile-x64-glb.exe

For Microsoft PowerPoint 2016 (32-bit edition):
powerpoint2016-kb3114518-fullfile-x86-glb.exe

For Microsoft PowerPoint 2016 (64-bit edition):
powerpoint2016-kb3114518-fullfile-x64-glb.exe

For Microsoft Visio 2016 (32-bit edition):
visio2016-kb3114511-fullfile-x86-glb.exe

For Microsoft Visio 2016 (64-bit edition):
visio2016-kb3114511-fullfile-x64-glb.exe

For Microsoft Word 2016 (32-bit edition):
word2016-kb3114526-fullfile-x86-glb.exe

For Microsoft Word 2016 (64-bit edition):
word2016-kb3114526-fullfile-x64-glb.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

Use Add or Remove Programs item in Control Panel.

File information

See Microsoft Knowledge Base Article 2920727
See Microsoft Knowledge Base Article 3114511
See Microsoft Knowledge Base Article 3114518
See Microsoft Knowledge Base Article 3114520
See Microsoft Knowledge Base Article 3114527

Registry key verification

Not applicable

Office for Mac 2011Prerequisites

  • Mac OS X version 10.5.8 or later version on an Intel processor

  • Mac OS X user accounts must have administrator privileges to install this security update

Installing the Update

Download and install the appropriate language version of the Microsoft Office for Mac 2011 14.6.0 Update from the Microsoft Download Center.

  1. Quit any applications that are running, including virus-protection applications and all Microsoft Office applications as they could interfere with the installation.

  2. Open the Microsoft Office for Mac 2011 14.6.0 Update volume on your desktop. This step might have been performed for you.

  3. To start the update process, in the Microsoft Office for Mac 2011 14.6.0 Update volume window, double-click the Microsoft Office for Mac 2011 14.6.0 Update application, and follow the instructions on the screen.

  4. When the installation finishes successfully, you can remove the update installer from your hard disk. To verify that the installation finished successfully, see Verifying Update Installation. To remove the update installer, first drag the Microsoft Office for Mac 2011 14.6.0 Update volume to the Trash, and then drag the file that you downloaded to the Trash.

Verifying Update Installation

To verify that a security update is installed on an affected system, follow these steps:

To do this, follow these steps:

  1. In Finder, navigate to the Application Folder (Microsoft Office 2011).

  2. Select Word, Excel, PowerPoint or Outlook and launch the application.

  3. On the application menu, click About Application_Name (where Application_Name is Word, Excel, PowerPoint or Outlook).If the Latest Installed Update Version number is 14.6.0, the update has been successfully installed.

Restart Requirement

This update does not require you to restart your computer.

Removing the Update

This security update cannot be uninstalled.

Additional Information

If you have technical questions or problems downloading or using this update, see Microsoft for Mac Support to learn about the support options that are available to you.

Office 2016 for MacPrerequisites

  • Mac OS X Yosemite 10.10 or later version on an Intel processor

  • A valid Microsoft Office 365 subscription

Installing the UpdateDownload and install the appropriate language version of the Microsoft Office 2016 for Mac 15.18.0 Update from the Microsoft Download Center.

  1. Quit any applications that are running, including virus-protection applications and all Microsoft Office applications as they could interfere with the installation.

  2. Open the Microsoft Office 2016 for Mac 15.18.0 Update volume on your desktop. This step might have been performed for you.

  3. To start the update process, in the Microsoft Office 2016 for Mac 15.18.0 Update volume window, double-click the Microsoft Office 2016 for Mac 15.18.0 Update application, and follow the instructions on the screen.

  4. When the installation finishes successfully, you can remove the update installer from your hard disk. To verify that the installation finished successfully, see Verifying Update Installation. To remove the update installer, first drag the Microsoft Office 2016 for Mac 15.18.0 Update volume to the Trash, and then drag the file that you downloaded to the Trash.

Verifying Update Installation

To verify that a security update is installed on an affected system, follow these steps:

  • In Finder, navigate to the Application Folder (Microsoft Office 2016).

  • Select Word, Excel, PowerPoint or Outlook and launch the application.

  • On the application menu, click About Application_Name (where Application_Name is Word, Excel, PowerPoint or Outlook).If the Latest Installed Update Version number is 15.18.0, the update has been successfully installed.

Restart Requirement

This update does not require you to restart your computer.

Removing the Update

This security update cannot be uninstalled.

Additional Information

If you have technical questions or problems downloading or using this update, see Microsoft for Mac Support to learn about the support options that are available to you.

Microsoft SharePoint Foundation 2013 (all versions)Reference Table

The following table contains the security update information for this software.

Security update file name

For Microsoft SharePoint Foundation 2013 Service Pack 1:
sts2013-kb3114503-fullfile-x64-glb.exe

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Removal information

This security update cannot be removed.

File Information

See Microsoft Knowledge Base Article 3114503

Registry key verification

Not applicable

Visual Basic 6.0 Runtime (all editions)Reference Table

The following table contains the security update information for this software.

Security update file name

For Visual Basic 6.0 Runtime:
VB60SP6-KB3096896-x86-CHS.msi

Installation switches

See Microsoft Knowledge Base Article 912203

Restart requirement

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 3096896.

Removal information

This security update cannot be removed.

File Information

See Microsoft Knowledge Base Article 3096896

Registry key verification

Not applicable


Help for installing updates: Support for Microsoft Update

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

Help for protecting your Windows-based computer from viruses and malware: Virus Solution and Security Center

Local support according to your country: International Support

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×