Description of the security update for Project 2016: November 13, 2018

Summary

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2018-8575.

Note To apply this security update, you must have the release version of Microsoft Project 2016 installed on the computer.

Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home (see Determining your Office version).

Improvements and fixes

This security update contains improvements and fixes for the following nonsecurity issues:

• When you save a project as an XML file, Project 2016 may crash. This issue can occur after you install the April 3, 2018, update for Project 2016 (KB 4018320).

• When you make changes in a project and then save it, the custom field lookup table values are also saved even though they have not been changed. Therefore, it takes longer to publish the project. And while the publishing processes, other actions such as viewing the tasks view in Project Web App may be slow.

• Assume that you update cost or work data for a subtask in Project 2016. When you save a baseline on the task and choose the option to roll up the baseline data to all summary tasks, the baseline data for task summary tasks within the sub project is rolled up but not to the inserted project summary tasks and summary tasks in the master project.

Consider the following scenario:

• You have a SharePoint document library.

• The document library list experience is set to the new "modern" experience.

• The document library versioning settings require checkout.

• You have a Project file stored in the library. You open the file from the library by  using Project 2016.

In this situation, you find that the expected "check out required" prompt isn't displayed, and therefore you can't respond. This means that if you make changes to the project and save, Project tells you that the changes can't be saved because checkout is required.

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

• Download security update KB 4461478 for the 32-bit version of Project 2016

• Download security update KB 4461478 for the 64-bit version of Project 2016

More Information

Security update deployment information

For deployment information about this update, see security update deployment information: November 13, 2018.

Security update replacement information

This security update replaces previously released security update KB 2920698.

File hash information

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

How to get help and support for this security update

Protect yourself online and at home: Windows Security support

Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure

Local support according to your country: International Support