Description of the security update for SharePoint Enterprise Server 2016: October 10, 2017

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2017-11775, Microsoft Common Vulnerabilities and Exposures CVE-2017-11777, Microsoft Common Vulnerabilities and Exposures CVE-2017-11820, and Microsoft Common Vulnerabilities and Exposures CVE-2017-11826.

Note To apply this security update, you must have the release version of Microsoft SharePoint Server 2016 installed on the computer.

This public update delivers Feature Pack 2 for SharePoint Server 2016, which contains the following feature:

• SharePoint Framework (SPFx)

This public update also delivers all of the features that were previously included in Feature Pack 1 for SharePoint Server 2016, including:

• Administrative Actions Logging
• MinRole enhancements
• SharePoint Custom Tiles
• Hybrid Auditing (preview)
• Hybrid Taxonomy
• OneDrive API for SharePoint on-premises
• OneDrive for Business modern experience (available to Software Assurance customers)

The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that it is enabled, either by installation of the public update or by manual enablement. If you don't have an active Software Assurance contract at the time of enablement, you must turn off the OneDrive for Business modern user experience.

For more information, see New features included in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1) and New features in September 2017 PU for SharePoint Server 2016 (Feature Pack 2).

This security update contains the following improvements and fixes for SharePoint Server 2016:

• Translate some terms in multiple languages to make sure that the meaning is accurate.

• Improve the export of versioned list items that are part of an IRM enabled list.

• Improve the opaque compound words breaking for Thai language.

• When SharePoint Server 2013 consumes search from SharePoint Server 2016 by using AAM (alternate access mapping) from a non-default zone, search is broken.

• Add term check logic to prevent an odd term that blocks hybrid taxonomy replication timer jobs.

• Assume that the administrator is changing the settings of a user profile at the central administration page. After the administrator saves and opens the profile again, the First day of week and First week of year properties are shifted by one count unexpectedly.

• Improves the efficiency of AAM caching in SharePoint Server 2016.

• More ULS log information will be added in upgrade scenarios for better troubleshooting in verbose mode.

• As part of SharePoint database upgrade, the members of the db_owner role are deleted from the role, except for the "dbo" user and the user who is performing the upgrade. This is done for enhanced security to make sure that an errant account isn't inadvertently left having the db_owner role privileges. However, there may be situations in which this behavior is not desirable. For example, RBS may be broken every time that an upgrade is run. In this situation, a registry key is added to bypass this behavior. 
  
  Note Before you install this update, follow the steps in the "Registry information" section to create the registry key.

• SharePoint mistakenly skips recycling the SharePoint Timer service at regular intervals due to an error in calculating how long the service has been running.

• When you use the Psconfig command-line tool to join a farm in a non-English version of Windows and then you select a SharePoint server role that hosts the Distributed Cache component, you experience the "cacheHostInfo is null" error.

• Increase the maximum number of unique terms indexed per field from 10000 to 1000000.

• Add a new field to control whether each custom tile is displayed or hidden in the app launcher.

• Improve the warning message when you try to use the Psconfig command-line tool to disconnect a server from a farm. The warning message will now inform the user that any services that are running on the server, including Search if it exists, will be removed if you disconnect the server from the farm.

• Improves the warning message when you try to use Central Administration to remove a server from the farm. The warning message emphasizes that you should use this mechanism only to remove orphaned servers from the farm. If the server still exists, you should use the Psconfig command-line tool or Windows PowerShell to remove the server from the farm.

• Assume that you have a page library that has the Require Check Out option and the Major and minor versioning option enabled. Then, a web part page that contains a list view web part with the default view applied is created and saved. When you open the page for editing again, a custom JSLink view can't be saved on the list view web part.

• If you delete a term and then create a term by using the same ID, the hybrid taxonomy replication timer jobs fails and you experience an exception (object is invalid or key not found) if the deletion isn't committed before the new creation.

This security update contains the following improvements and fixes for Project Server 2016:

• Some summary resource assignment work or actual work values may have large negative numbers. This issue may cause the project publish process to fail.

• After you add yourself to a task by using the Add yourself to a task option for a timesheet, the new assignment request is sent to the project owner instead of to the task manager for the task.