Description of the security update for SharePoint Enterprise Server 2016: June 12, 2018

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2018-8252 and Microsoft Common Vulnerabilities and Exposures CVE-2018-8254.

Note To apply this security update, you must have the release version of SharePoint Enterprise Server 2016 installed on the computer.

This public update delivers Feature Pack 2 for SharePoint Server 2016, which contains the following feature:

• SharePoint Framework (SPFx)

This public update also delivers all the features that were included in Feature Pack 1 for SharePoint Server 2016, including:

• Administrative Actions Logging
• MinRole enhancements
• SharePoint Custom Tiles
• Hybrid Auditing (preview)
• Hybrid Taxonomy
• OneDrive API for SharePoint on-premises
• OneDrive for Business modern experience (available to Software Assurance customers)

The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that the experience is enabled, either by installation of the public update or by manual enablement. If you don't have an active Software Assurance contract at the time of enablement, you must turn off the OneDrive for Business modern user experience.

For more information, see New features included in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1) and New features included in the September 2017 Public Update for SharePoint Server 2016 (Feature Pack 2).

This security update contains improvements and fixes for the following nonsecurity issues in SharePoint Enterprise Server 2016:

• Assume that you use the content editor web part (CEWP) to enter an incorrectly spelled word on a SharePoint page. When you publish the page, the incorrectly spelled word is not underlined, and some letters are deleted.

• Full date format uses nominative instead of genitive for month names for some regions. For example, 13 styczen (nominative) is displayed instead of 13 stycznia (genitive) for Polish.

• During the AD import for user profile application (UPA), default property settings are reflected for the Work Email property even if the mapping is customized.

• Cyrillic characters are not localized correctly in sites, lists, and document names on the Summary page that is created by the Send to connections feature.

• Some parts of attachments remain in the database even after the containing folder of the parent list item is deleted. After you install this update and the database is upgraded, subsequent folder deletions delete all parts of the attachments that are associated within the contained list items.

• When you try to synchronize a custom time zone from a Business Data Connectivity (BDC) database to a User Profile Application (UPA) database, you receive the System.InvalidOperationException exception.

• The Move-SPSite cmdlet causes data loss if Remote BLOB Storage (RBS) is enabled.

• When you select a term from the managed metadata on a column header in order to filter a task list, you receive the following error message:

  There are no items to show in this view.

• The CSOM LookupTable.Entries.Remove() method fails and returns the error:

  PJClientCallableException: CICONotCheckedOut CICONotCheckedOut.