Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Description of the security update for Project 2016: April 14, 2020


View products that this article applies to.

Summary

This security update resolves a remote code execution vulnerability that exists if Microsoft Office incorrectly loads arbitrary type libraries. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2020-0760.

Note To apply this security update, you must have the release version of Project 2016 installed on the computer.

Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home (see What version of Office am I using?).

↑ Back to the top


Known issues

Some types of Visual Basic for Applications (VBA) references might be affected by this update. For more information, see FAQ for VBA solutions affected by April 2020 Office security updates.

Note This change in behavior is caused by a design change in Office. The new behavior is by design. Therefore, a fix is not necessary and no mitigation will be provided.

↑ Back to the top


Improvements and fixes

This security update contains fixes for the following nonsecurity issue:

  • Users can't create external task dependencies in the Japanese version of Project 2016. For example, creating a predecessor from a task in one project to a task in a different project.
  • The OnUndoOrRedo event within a COM Add-in doesn't fire without first enabling a transaction.
  • Assume that the timescale is set up to have a middle and bottom timescale set to Quarters over Months. When you print the timescale together with the Hriji calendar, the ending month in the quarter may get clipped. For example, the "Oct" month is moved into the third quarter, and "Sep" is skipped completely.
  • The ProjectBeforeTaskChange event doesn't fire when you select the Inactivate button in the Scheduling group on the Tasks tab.
  • Consider the following scenario:
    • A project is saved to Project Server.
    • The project has a local custom field that has a lookup table.
    • The CustomFieldGetValueListGetItem method is invoked on a local custom field that doesn’t have a lookup table.
    • The project is closed, saved, and checked in.

In this scenario, the values that are in the local custom field on which the method is run may be lost.

↑ Back to the top


How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the standalone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

↑ Back to the top


More Information

Security update deployment information

For deployment information about this update, see security update deployment information: April 14, 2020.

Security update replacement information

This security update replaces previously released security update 4475589.

File hash information

File name SHA1 hash SHA256 hash
project2016-kb4484269-fullfile-x64-glb.exe 4B159B15FF7380D82BAA3CEC88794DE072659CE3 BF8EAE6B7AD69F9B82FCBD0DEBCD29424B0D4BD52A66B45E2C364B16C8C82AA5
project2016-kb4484269-fullfile-x86-glb.exe 9CE49CA9A51A1104716115F63CF7E2DAE0DEC72C 6187E07ACAC43DD223C8EF62E5A12F7C4B6D92D540BE1F90DE49AD33789A52BC


File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

For all supported x86-based versions of Project 2016
For all supported x64-based versions of Project 2016

↑ Back to the top


Information about protection and security

Protect yourself online: Windows Security support

Learn how we guard against cyber threats: Microsoft Security

↑ Back to the top


Keywords: kbBug, kbfix, kbExpertiseInter, kbSecReview, KbSECBulletin, KbSECVulnerability, ATdownload, kbMustLoc, kbLangAll, kbSecurity, kbsurveynew

↑ Back to the top

Article Info
Article ID : 4484269
Revision : 13
Created on : 4/20/2020
Published on : 4/20/2020
Exists online : False
Views : 365