MS16-004: Description of the security update for SharePoint Foundation 2013: January 12, 2016

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file. To learn more about these vulnerabilities, see Microsoft Security Bulletin MS16-004.

Note To apply this security update, you must have the release version of Service Pack 1 for Microsoft SharePoint Foundation 2013 installed on the computer.

For a complete list of affected versions of Microsoft Office software, see Microsoft Knowledge Base article 3124585.

Improvements and fixes

• Adds a function to set the SPWeb.RequestAccessEmail property by using a client-side object model (CSOM).
  
• This update also contains fixes for the following nonsecurity issues:
  
  • When you check permissions, incorrect permissions are reported based on group memberships across trusted domain boundaries. Therefore, external token isn't populated with security groups of trusted domains.
    
  • If a SQL Server Report Viewer Web Part is created before Service Pack 1, a page that contains the Report Viewer Web Part can't be loaded, and you receive the following error message:
    You must first select a report to display in this Web Part. Do this by opening the tool pane and specifying the path and file name of the Reporting Services report that you would like to show. Alternatively, you can connect the Web Part to another Web Part on the page that provides a document path.
  • After you create a view in a publishing sub site, the view is displayed in the datasheet view. Meanwhile, you receive the following error message:
    The list is displayed in Standard view. It cannot be displayed in Datasheet view for one or more of the following reasons: A datasheet component compatible with Microsoft SharePoint Foundation is not installed, your browser does not support ActiveX controls, a component is not properly configured for 32-bit or 64-bit support, or support for ActiveX controls is disabled.
  • When you select the Save button multiple times on the ribbon to add an item to a list, the item is added multiple times.
    
  • When you try to update the configuration database for the host-named site collections by using the SPContentDatabase.RefreshSitesInConfigurationDatabase method, the sites become unavailable if the site collections are set in separate content databases from the root site collection.
    
  • Assume that you have a site collection that has the document ID feature enabled or a Url field that points to a resource within the site collection. Then, you check out a document and move the content database of the site collection to another web application. After you check in the document, the URL of the document points to the old site.