Microsoft April 2020 Security Updates

The Microsoft April security updates have been released and consist of 113 CVEs. Of these CVEs, 17 are rated Critical and 96 are rated Important in severity. Two of the bugs* One of the bugs addressed this month is listed as being under active attack, and two are listed as being public at the time of release.

*Edit Note: Microsoft initially listed CVE-2020-0968 a being under active attack. They have since revised this bulletin to note it is not under attack.

The updates apply to the following:  Microsoft Windows, Microsoft Edge (EdgeHTML-based), Microsoft Edge (Chromium-based), ChakraCore, Internet Explorer, Microsoft Office and Microsoft Office Services and Web Apps, Windows Defender, Visual Studio, Microsoft Dynamics, Microsoft Apps for Android, and Microsoft Apps for Mac.

The KBs listed below contain information about known issues with the security updates.

KB Article	Applies To
3128012	Microsoft Office 2016
3162033	Microsoft Publisher 2013
3203462	Microsoft Office 2010
4011097	Microsoft Publisher 2016
4011104	Microsoft Office 2013
4032216	Microsoft Publisher 2010
4462210	Microsoft Access 2013
4462225	Microsoft Visio 2010
4464527	Microsoft Access 2010
4464544	Microsoft Visio 2013
4484117	Microsoft Office 2013
4484125	Microsoft Project 2013
4484126	Microsoft Office 2010
4484132	Microsoft Project 2010
4484167	Microsoft Access 2016
4484214	Microsoft Office 2016
4484226	Microsoft PowerPoint 2013
4484235	Microsoft PowerPoint 2010
4484244	Microsoft Visio 2016
4484246	Microsoft PowerPoint 2016
4484269	Microsoft Project 2016
4484273	Microsoft Excel 2016
4484274	Microsoft Outlook 2016
4484281	Microsoft Outlook 2013
4484283	Microsoft Excel 2013
4484284	Microsoft Outlook 2010
4484285	Microsoft Excel 2010
4484295	Microsoft Word 2010
4484300	Microsoft Word 2016
4484319	Microsoft Word 2013
4549949	Windows 10 Version 1809, Windows Server 2019
4550905	Internet Explorer
4550917	Windows Server 2012 (Monthly Rollup)
4550922	Windows 10, version 1803
4550927	Windows 10, version 1709
4550929	Windows 10, version 1607, Windows Server 2016
4550930	Windows 10
4550951	Windows Server 2008 Service Pack 2 (Monthly Rollup)
4550957	Windows Server 2008 Service Pack 2 (Security-only update)
4550961	Windows 8.1, Windows Server 2012 R2 (Monthly Rollup)
4550964	Windows 7, Windows Server 2008 R2 (Monthly Rollup)
4550965	Windows 7, Windows Server 2008 R2 (Security-only update)
4550970	Windows 8.1, Windows Server 2012 R2 (Security-only update)
4550971	Windows Server 2012 (Security-only update)

Recommended Reading:  

See Dustin Childs review and analysis in Zero Day Initiative — The April 2020 Security Update Review.

For more information about the updates released today, see https://portal.msrc.microsoft.com/en-us/security-guidance/summary.  Updates can be sorted by OS from the search box. Information about the update for Windows 10 is available at Windows 10 Update history.

Additional Update Notes:

• Adobe Flash Player -- For Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1 and Windows 10, Adobe Flash Player is now a security bulletin rather than a security advisory and is included with the updates as identified above. Note, however, that there are no Adobe Flash Player security updates for Active X.
• MSRT -- Microsoft released an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.  Note:  Users who are paranoid about the remote possibility of a FP can opt to run this tool from a Command Prompt, appending a   /N   parameter [for "detect only" mode].
• Servicing Stack Updates -- A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update. Learn more about SSU's in Servicing Stack Updates (SSU)
• Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are also available via the Microsoft Update Catalog.
• For information on lifecycle and support dates for Windows 10 operating systems, please see Windows Lifecycle Facts Sheet.
• Windows Update History:
  • Windows 10
  • Windows 8.1

References

• Security Update FAQ
• April Security Updates Guide

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...