Description of the security update for SharePoint Server 2019: June 9, 2020

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see the following security advisories:

• Microsoft Common Vulnerabilities and Exposures CVE-2020-1148
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1177
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1178
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1181
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1183
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1295
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1297
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1298
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1318
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1320
• Microsoft Common Vulnerabilities and Exposures CVE-2020-1323

Note To apply this security update, you must have the release version of Microsoft SharePoint Server 2019 installed on the computer.

This security update contains improvements and fixes for the following nonsecurity issues in SharePoint Server 2019.

• Adds prompting for add-ins to be enabled when they originate from an unknown location.
  
  Note To enable this improvement, you have to install KB 4484330 together with this update.
• Makes sure that files that are empty (0 KB in size) are skipped when the automatic Declare as Record feature is applied to a library. This prevents situations in which the upload of files fails if it is run together with auto-declaration of in-place records management. This is because a file "stub" is created before the file is finished uploading when large files are uploaded.
• In certain repetitive scenarios, the relevant worker process may show an increasing memory consumption pattern that is eventually followed by process termination.
  
  This update fixes this issue by ensuring a standard memory consumption pattern.
• Modern team sites don't support Multiple Language User Interface (MUI) in the site title.
• A folder that is opened by Internet Explorer doesn't work if the folder name contains a pound sign (#).
• A profile synchronization timer job fails to sync integer-type replicable mapped user properties with the User Information list.
• If you input only space characters in the SharePoint People Picker, the People Picker resolves these characters to the "All Users (Windows)" claims identity. This update fixes the issue.
• In a SharePoint server farm that has a publishing farm and a consuming farm, the consuming farm associates User Profile Service applications (UPA) and Managed Metadata Web Service (MMS) services that are published by the publishing farm. When a user on the consuming farm accesses the document library and tries to share a file or folder to another user, the following error message appears: "Sorry, we're unable to reach the server right now. Please try again later." 
• Regional settings are incorrect for the Santiago (Chile) time zone.
  
  Note To fix this issue completely, you have to install KB 4484404 together with this update.
• The HTTP request to _api/contextinfo endpoint contains "undefined" in the message body.
  
  Note To fix this issue completely, you have to install KB 4484404 together with this update.

This security update also contains improvements and fixes for the following accessibility issues in SharePoint Server 2019.

• Improves the translation of the "Required Field" string in taxonomy fields of a classic page.
  
  Note To enable this improvement, you have to install KB 4484404 together with this update.
• The required information is missing in the People field of the classic page.
  
  Note To fix this issue completely, you have to install KB 4484404 together with this update.
• The required information is missing in the Rich Text Editor of a classic page.
  
  Note To fix this issue completely, you have to install KB 4484404 together with this update.
• The required information is missing in the classic document library folder creation experience.
  
  Note To fix this issue completely, you have to install KB 4484404 together with this update.
• The required information is missing in taxonomy fields of the classic page.
  
  Note To fix this issue completely, you have to install KB 4484404 together with this update.
• Job Access With Speech (JAWS) or screen reader users can't detect the current filter or sort status of a list view.
  
  Note To fix this issue completely, you have to install KB 4484404 together with this update.
• Job Access With Speech (JAWS) users cannot identify the selected state of rows about the List View control.
• In Discussion Board, missing ALT information for expanding or collapsing graphics causes issues for Job Access With Speech (JAWS) users.
• Two inputs wrapping every callout are identified and output by Job Access With Speech (JAWS).
• ViewSelectorMenu uses the "menu" role, but it should use the "navigation" role to align with SharePoint 2013.
• The screen reader reports all items of the Global Navigation menu even if the item is collapsed, it should report only items that are expanded.

This security update contains fixes for the following nonsecurity issues in Project Server 2019:

• In the Google Chrome and Microsoft Edge Chromium browsers, when you leave pages such as the Project and Resource Center, changes that you made (such as adjusting column widths) are not saved.
  
  Note For this fix to work, you have to first install Chrome or Chromium browser version 81 or a later version.
• The Resource Request page may unexpectedly display engagements from other resources.
• In the Google Chrome and Microsoft Edge Chromium browsers, even if you select Cancel in the Edit Resource page, the resources remain checked out.
  
  Note For this fix to work, you have to install Chrome or Chromium browser version 81 or a later version.
• Consider the following scenario:
  • You create a user from Manage Users. You do not select the User can be assigned as a resource option.
  • Later, you edit the user account and you enable the option.
  • You go to the Resource Center and select Capacity Planning button or go to Capacity Planning page with the page URL.
    
    In this situation, a dialog box appears and states "There is no availability data for the resources you have selected. This commonly occurs for cost and material resources without enterprise resource calendars."