Summary
This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2017-11775, Microsoft Common Vulnerabilities and Exposures CVE-2017-11777, Microsoft Common Vulnerabilities and Exposures CVE-2017-11820, and Microsoft Common Vulnerabilities and Exposures CVE-2017-11826.
Note To apply this security update, you must have the release version of Microsoft SharePoint Server 2016 installed on the computer.
This public update delivers Feature Pack 2 for SharePoint Server 2016, which contains the following feature:
-
SharePoint Framework (SPFx)
This public update also delivers all of the features that were previously included in Feature Pack 1 for SharePoint Server 2016, including:
-
Administrative Actions Logging
-
MinRole enhancements
-
SharePoint Custom Tiles
-
Hybrid Auditing (preview)
-
Hybrid Taxonomy
-
OneDrive API for SharePoint on-premises
-
OneDrive for Business modern experience (available to Software Assurance customers)
The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that it is enabled, either by installation of the public update or by manual enablement. If you don't have an active Software Assurance contract at the time of enablement, you must turn off the OneDrive for Business modern user experience.
For more information, see New features included in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1) and New features in September 2017 PU for SharePoint Server 2016 (Feature Pack 2).
Improvements and fixes
This security update contains the following improvements and fixes for SharePoint Server 2016:
-
Translate some terms in multiple languages to make sure that the meaning is accurate.
-
Improve the export of versioned list items that are part of an IRM enabled list.
-
Improve the opaque compound words breaking for Thai language.
-
When SharePoint Server 2013 consumes search from SharePoint Server 2016 by using AAM (alternate access mapping) from a non-default zone, search is broken.
-
Add term check logic to prevent an odd term that blocks hybrid taxonomy replication timer jobs.
-
Assume that the administrator is changing the settings of a user profile at the central administration page. After the administrator saves and opens the profile again, the First day of week and First week of year properties are shifted by one count unexpectedly.
-
Improves the efficiency of AAM caching in SharePoint Server 2016.
-
More ULS log information will be added in upgrade scenarios for better troubleshooting in verbose mode.
-
As part of SharePoint database upgrade, the members of the db_owner role are deleted from the role, except for the "dbo" user and the user who is performing the upgrade. This is done for enhanced security to make sure that an errant account isn't inadvertently left having the db_owner role privileges. However, there may be situations in which this behavior is not desirable. For example, RBS may be broken every time that an upgrade is run. In this situation, a registry key is added to bypass this behavior.
Note Before you install this update, follow the steps in the "Registry information" section to create the registry key. -
SharePoint mistakenly skips recycling the SharePoint Timer service at regular intervals due to an error in calculating how long the service has been running.
-
When you use the Psconfig command-line tool to join a farm in a non-English version of Windows and then you select a SharePoint server role that hosts the Distributed Cache component, you experience the "cacheHostInfo is null" error.
-
Increase the maximum number of unique terms indexed per field from 10000 to 1000000.
-
Add a new field to control whether each custom tile is displayed or hidden in the app launcher.
-
Improve the warning message when you try to use the Psconfig command-line tool to disconnect a server from a farm. The warning message will now inform the user that any services that are running on the server, including Search if it exists, will be removed if you disconnect the server from the farm.
-
Improves the warning message when you try to use Central Administration to remove a server from the farm. The warning message emphasizes that you should use this mechanism only to remove orphaned servers from the farm. If the server still exists, you should use the Psconfig command-line tool or Windows PowerShell to remove the server from the farm.
-
Assume that you have a page library that has the Require Check Out option and the Major and minor versioning option enabled. Then, a web part page that contains a list view web part with the default view applied is created and saved. When you open the page for editing again, a custom JSLink view can't be saved on the list view web part.
-
If you delete a term and then create a term by using the same ID, the hybrid taxonomy replication timer jobs fails and you experience an exception (object is invalid or key not found) if the deletion isn't committed before the new creation.
This security update contains the following improvements and fixes for Project Server 2016:
-
Some summary resource assignment work or actual work values may have large negative numbers. This issue may cause the project publish process to fail.
-
After you add yourself to a task by using the Add yourself to a task option for a timesheet, the new assignment request is sent to the project owner instead of to the task manager for the task.
How to get and install the update
Method 1: Microsoft Update Catalog
To get the stand-alone package for this update, go to the Microsoft Update Catalog website.
Method 2: Microsoft Download Center
You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.
More Information
Registry information
Important
Follow the steps in this section carefully. Serious problems might occur if you change the registry incorrectly. Before you change it, back up the registry for restoration in case problems occur.
After you install this update, you can follow these steps to control the metafiles optimization:
-
Start Registry Editor:
-
In Windows Server 2012, if you're using a mouse, move it to the upper-right corner, go to Search, and then enter regedit in the search text box.
-
Select regedit.exe in the search results.
-
-
Locate and then select the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\WSS\
-
On the Edit menu, point to New, and then select DWORD Value.
-
Enter BypassDboDropMember, and then press the Enter key.
-
In the Details pane, press and hold (or right-click) BypassDboDropMember, and then select Modify.
-
In the Value data box, enter 1, and then select OK.
Note If you don't want to bypass the behavior, you can set the value to 0. -
Exit Registry Editor.
Security update deployment information
For deployment information about this update, see security update deployment information: October 10, 2017.
Security update replacement information
This security update replaces previously released security update KB 4011127.
File hash information
|
Package Name |
Package Hash SHA 1 |
Package Hash SHA 2 |
|---|---|---|
|
sts2016-kb4011217-fullfile-x64-glb.exe |
98A683C59490636F0B1AC0FD8B714375B8E5E9E7 |
9310341BBFBEEDC8C877195694D3A362A8F7517AD162BBE6F0FBFD874A076E2B |
File information
For the list of files that cumulative update 4011217 contains, download the file information for update 4011217.
How to get help and support for this security update
Help for installing updates: Windows Update FAQ
Security solutions for IT professionals: Security Support and Troubleshooting
Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure
Local support according to your country: International Support
Propose a feature or provide feedback on SharePoint: SharePoint User Voice portal
