January Security Patch Can Break SharePoint 2013

Update: Today, Microsoft's Stefan Gossner described a workaround by installing patch KB3114508, released on Jan. 5. Klindt, in an update to his blog post, explained that it was an "individual patch from the Foundation CU that fixes" the problem. However, he noted that the patch should be tested first, as it can't be uninstalled.


A January security update from Microsoft apparently is adversely affecting some SharePoint Server 2013 deployments.

Microsoft MVP Todd Klindt singled out MS16-004 (KB3124585) as the culprit in a blog post today. It's a security update that patches a remote code execution flaw in Microsoft Office and SharePoint Server 2013.

The problem shows up for SharePoint Server 2013 environments as a "TypeError" notice, according to a Microsoft user forum cited by Klindt. So far, though, there's been no notice from Microsoft about the problem.

Klindt explained the patch as just being an issue just for those organizations that have enabled automatic updates via Windows Update for SharePoint Server 2013 environments, which he characterized as a not recommended practice. The issue specifically affects organizations that "did not install the full January 2016 SharePoint CU," he added.

"It seems people that installed KB3124585 from Windows Update, but did not install the full January 2016 SharePoint CU are having problems," Klindt wrote.

Microsoft released cumulative updates (CUs) for SharePoint Server 2013 and SharePoint Server 2010 on Jan. 12, the same day as its January security update releases.

There's no rollback for those experiencing the problem. That's one of the reasons why Klindt advises against enabling automatic updates for SharePoint Server via Windows Update. Instead, Klindt indicated that applying the January CU for SharePoint Foundation will fix the problem. However, that action, too, is irreversible should something go wrong, he noted.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.


  • Microsoft Starting To Roll Out New Excel Connected Data Types

    Microsoft on Thursday announced some Excel and Power BI enhancements that add "connected data types" on top of the standard strings and numbers options.

  • Windows 10 Users Getting New Process for Finding Optional Driver Updates

    Accessing Windows 10 drivers classified as "optional updates" will be more of a manual seek-and-install type of experience, starting on Nov. 5, 2020, Microsoft explained in a Wednesday announcement.

  • Microsoft Changes Privacy Platform Name to SmartNoise

    Microsoft Research has changed the name of its "differential privacy" platform from "WhiteNoise" to "SmartNoise," according to a Wednesday announcement.

  • Why Restarting a Failed SCVMM Job Might Be a Bad Idea

    Occasionally, restarting a failed System Center Virtual Machine Manager job can leave your virtualization infrastructure in an unknown state. Here's how to avoid that.

comments powered by Disqus