MS16-014: Description of the security update for Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2: February 9, 2016

You can obtain the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

Click the download link in the following table that corresponds to the version of Windows that you are running. Find out if your computer is running the 32 or 64-bit version of Windows

After you install this security update and an issue occurs when an implicit dependency is loaded, a warning or error message that resembles one of the following may appear in a Windows event log:

• This warning message indicates the dependency file was not loaded from the current working directory (CWD) but was found in another, more trusted location:
  
  Loading dependency %2 from the current directory was not allowed when attempted by %1. Another DLL was found: %3. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136
  
  
• This error message indicates the .dll was not loaded from the current working directory (CWD) and was not found in another location:
  
  Loading dependency %2 from the current directory was not allowed when attempted by %1. No other DLL was found and the dependency resolution failed. For more information, see http://go.microsoft.com/fwlink/?LinkId=718136

In both cases, %1 is the full path to the application process’s executable (.exe) file, and %2 is the full path if the DLL is found in the CWD.



After you install this security update, the behavior of searching for DLLs to load in certain scenarios (specifically, when loading implicit dependencies of COM server DLLs) will be changed from the previous behavior in the following way: Unless a prefix of the current directory’s full path is in the Safe Load List, the current directory will be skipped during the search (notice that previously, the current directory was used to search for the DLL). This new behavior may affect some legacy application behavior, and when the DLL loader notices this possible change in behavior, a warning or error message that resembles one of the messages mentioned earlier may be displayed in the Application log that is available in Event Viewer.

If the application requires the old dependency loading behavior for its correct operation for a specific directory, you can achieve this scenario by adding this directory or its trusted ancestor to the Safe Load List. To do this, follow these steps:

1. Make sure that your trusted location, together with all its descendant tree, is protected properly from unauthorized modifications by NTFS permissions.
2. Add a new string value to the following subkey in the registry in which the data is the full path of that trusted location:
   HKLM\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes
   The name of that value can be arbitrary, and the data of that value is the full path of that trusted location.

After you make these changes, as long as the CWD is under that location, the DLLs in that CWD will be trusted and loaded as before.