Lync 2013 / SfB 2015 Client Security Update – September 2015

This month we have another security update – and this time it includes some fixes and new/changed functionality!

Kb3085500: MS15-097: Description of the security update for Microsoft Lync 2013 (Skype for Business): September 8, 2015:

“This security update resolves vulnerabilities in Microsoft Lync 2013. These vulnerabilities could allow remote code execution if a user opens a specially crafted document or goes to an untrusted webpage that contains embedded OpenType fonts. To learn more about the vulnerabilities, see Microsoft Security Bulletin MS15-097.”

What’s Fixed?

  • Kb3088665 Adds an AllowSavePassword Group Policy setting to remove the Save Password check box in Skype for Business or Lync 2013
  • Kb3088668 Non-ASCII characters are removed from search box in Skype for Business or Lync 2013
  • Kb3088667 “c0000005” error occurs and Skype for Business or Lync 2013 crashes when you upload a file to a persistent chat room
  • Kb3088669 Your phone numbers disappear when you expand a distribution group in contact list in Skype for Business or Lync 2013
  • Kb3088664 The “Copy” and “Select All” options are disabled for the first instant message in Skype for Business or Lync 2013
  • Kb3088660 Skype for Business or Lync 2013 SDK provides the same window handle value for different PSTN conversation windows
  • Kb3088671 The updated address book can’t be downloaded in Skype for Business or Lync 2013
  • Kb3088670 Call transfer doesn’t transfer a call to the contact that you select in Skype for Business or Lync 2013

What’s New?

    • Kb3088666 Update changes the text label from “Skype call” to “Skype for Business call” in Skype for Business or Lync 2013

Before

After

Sept2015ClientSecurityUpdate-SkypeCall-Before2 Sept2015ClientSecurityUpdate-SfBCall-After2

(I’ve only captured one appearance, but you’ll find this change has been made throughout the client).

Known Issues

Kb3099414 You can’t record after you install MS15-097 for Lync 2013 (Skype for Business):

Consider the following scenario:

  • You install security update 3085500 that is documented in security bulletin MS15-097 Security Update for Lync 2013 (Skype for Business) that was released on September 8, 2015.
  • You join a meeting by using the Skype for Business client (version: 15.0.4753.1000).
  • You click the More Options button, and then you click Start Recording.

In this scenario, nothing happens. You don’t see any notification or visual indication that recording has started. Additionally, when you open the recording manager, you don’t see any file or progress status.

Pre-Req’s

A few people have found their recent updates haven’t delivered as expected. Don’t forget *all* of the pre-req’s.

This list is unchanged from last month’s Security Update:

Update

Download

Current Version

Released

Update for Office 2013 (KB3054853)
(NOTE 1 BELOW)
1.0 9 June 2015
LyncHelpLoc (kb2889853) 1.0 13 April 2015
Microsoft Office 2013 Language Pack Service Pack 1 (KB2817427) 1.0 13 February 2014

NOTE1: “You do not have to apply update KB3054853 if you applied the April 14, 2015, update (KB2889923) or the May 12, 2015, security update (KB3039779) for Lync 2013 (Skype for Business)”.

Download

This is the client fix itself:

  • x86 (lync2013-kb3085500-fullfile-x86-glb.exe)
  • x64 (lync2013-kb3085500-fullfile-x64-glb.exe)

Reboot?

In my case, no. I was prompted to close Outlook – to which I complied – and the update completed with no need for a reboot.

Before / After

Before

After

SfB 15.0.4745.1000 MSO 15.0.4737.1001 SfB 15.0.4753.1000 MSO 15.0.4737.1001
Sept2015ClientSecurityUpdate-Before Sept2015ClientSecurityUpdate-After

Revision History

11th September. This is the initial post.
3rd October: Added known issue Kb3099414.

G.

Leave a Reply

Your email address will not be published.

... and please just confirm for me that you're not a bot first: Time limit is exhausted. Please reload the CAPTCHA.

This site uses Akismet to reduce spam. Learn how your comment data is processed.