Description of the security update for SharePoint Server 2016: December 12, 2017

Summary

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2017-11936.

Note To apply this security update, you must have the release version of SharePoint Server 2016 installed on the computer.

This public update also delivers all the features previously included in Feature Pack 1 for SharePoint Server 2016, including:

• Administrative Actions Logging

• MinRole enhancements

• SharePoint Custom Tiles

• Hybrid Auditing (preview)

• Hybrid Taxonomy

• OneDrive API for SharePoint on-premises

• OneDrive for Business modern experience (available to Software Assurance customers)

The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that it is enabled, either by installation of the public update or by manual enablement. If you don't have an active Software Assurance contract at the time of enablement, you must turn off the OneDrive for Business modern user experience.

For more information, see New features included in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1) and New features included in the September 2017 Public Update for SharePoint Server 2016 (Feature Pack 2).

Improvements and fixes

This security update contains improvements and fixes for the following nonsecurity issues:

• Assume that you have an enterprise resource that is a part of a team assignment pool. When you go to the Resource Center, select the resource and then click the Capacity Planning button, the resource is not displayed, and in some cases you see the error “Sorry, something went wrong.”

• When you set properties that are imported from Active Directory by using the user interface, certain unchecked containers other than organization unit (OU) scope are not respected.

• Consider the following scenario:

  • A project manager publishes a task to a team member.

  • The team member goes to their timesheet and enters actual work on the task.

  • The timesheet is submitted and then approved.

  • The project in which the task exists is deleted.

  • The team member goes back to their timesheet.

  In this situation, the task on which the actual work was submitted is no longer there.

• This update fixes an issue where the top report part of the Search Reports would count the same queries incorrectly with different casing. For example, “query”, “QUERY”, and “Query” were treated as unique query texts and counted accordingly. This fix lowercases the query text before calculating the counts.

• When you search Chinese-Simplified or Chinese-Traditional content in SharePoint 2016, you may not see the relevant results or the query keywords may not be highlighted in the results. This issue occurs because the search falls back to the English word breaker when the query is Chinese-Simplified or Chinese-Traditional based. This update resolves the issue so that the correct word breaker is selected.

• When you search for keywords that contain some specific Korean characters, the search fails because the token length is calculated incorrectly.

• When you delete a value from a custom field that's configured to display a graphical indicator, the record in the database is not deleted, but instead the value is set to NULL, and the indicator value is preserved in reporting.

• This update reduces the default version limit number for the default document library on new SharePoint 2016 team sites from 500 down to 10. This will make storage capacity planning easier.

• This update changes the short names of the services that are using a built-in service account to friendly display names so that it’s easy to understand what service is described in the SharePoint health rules report. 

• This update improves the Thai word breaker for complex compound words when you search in SharePoint.

• Translates some terms in multiple languages to make sure that the meaning is accurate.

• This update also has the following improvements:

  • Improves the SharePoint Health Analyzer algorithm that checks the free space on drives to handle large drives better. The algorithm will now report a warning if the free disk space is less than 10 GB or report an error if the free disk space is less than 4 GB.

  • Removes the following five health analyzer rules to reduce noise:

    • Health Analyzer: Validate the My Site Host and individual My Sites are on a dedicated Web application and separate URL domain

    • Health Analyzer: Database has large amounts of unused space

    • Health Analyzer: Alternate access URLs have not been configured

    • Health Analyzer: People search relevance is not optimized when the Active Directory has errors in the manager reporting structure

    • Health Analyzer: Search - One or more crawl databases may have fragmented indices

How to get and install the update

More Information

How to get help and support for this security update

Help for installing updates: Windows Update FAQ

Security solutions for IT professionals: Security Support and Troubleshooting

Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure

Local support according to your country: International Support

Propose a feature or provide feedback on SharePoint: SharePoint User Voice portal