This week’s security update takes the Office 2013-based Lync/SfB client from 15.0.4859.1000 to 15.0.4867.1001. It’s listed as Critical as there’s the risk of remote code execution.
Kb3118348 “MS16-120: This security update resolves vulnerabilities in Microsoft Lync 2013 and Skype for Business. The vulnerabilities could allow remote code execution if a user opens a specially crafted document or visits a webpage that contains specially crafted embedded fonts.
As well as the critical issue above, this security update contains fixes for the following nonsecurity issues:
- Kb3193843 Lync 2013 (Skype for Business) connects through the DirectAccess tunnel when you connect to an external network
- Kb3195495 Skype for Business doesn’t open the Outlook window when you try to “Find Previous Conversations”
What’s New / Changed
There are no changes here from recent updates, so if you’re already current you only need the patch itself, below under “Download”. If however your patching isn’t to current, then you’ll need to check you have *all* of these pre-req’s. The Office 2013 SP1 requirement still applies if you’re using Outlook 2010. (Lync 2013 in all of its flavours – e.g. Lync Basic – is still a component of Office 2013).
|Update for Office 2013 (KB3054853) (NOTE 1 BELOW)||1.0||9 June 2015|
|LyncHelpLoc (Kb3039776)||1.0||1 December 2015|
|Microsoft Office 2013 Language Pack Service Pack 1 (KB2817427)||1.0||13 February 2014|
This is the client fix itself:
I have all the pre-req’s already installed, so a reboot was not required. I was however running Outlook 2013 at the time and I was prompted to exit it, to which I duly complied.
Before / After
|SfB 15.0.4859.1000 MSO 15.0.4867.1001||SfB 15.0.4867.1000 MSO 15.0.4867.1001|
14th October 2016: This is the initial post.