CVE-2016-3262

FAQ

I am running Office 2010, which is listed as affected software. Why am I not being offered the update?  The update is not applicable to Office 2010 on Windows Vista and later versions of Windows because the vulnerable code is not present.

I am being offered this update for software that is not specifically indicated as being affected in the Affected Software and Vulnerability Severity Ratings table. Why am I being offered this update? When updates address vulnerable code that exists in a component that is shared between multiple Microsoft Office products or shared between multiple versions of the same Microsoft Office product, the update is considered to be applicable to all supported products and versions that contain the vulnerable component.

For example, when an update applies to Microsoft Office 2007 products, only Microsoft Office 2007 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2007, Microsoft Excel 2007, Microsoft Visio 2007, Microsoft Compatibility Pack, Microsoft Excel Viewer, or any other Microsoft Office 2007 product that is not specifically listed in the Affected Software table. Furthermore, when an update applies to Microsoft Office 2010 products, only Microsoft Office 2010 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2010, Microsoft Excel 2010, Microsoft Visio 2010, Microsoft Visio Viewer, or any other Microsoft Office 2010 product that is not specifically listed in the Affected Software table.

For more information on this behavior and recommended actions, see Microsoft Knowledge Base Article 830335. For a list of Microsoft Office products an update may apply to, refer to the Microsoft Knowledge Base Article associated with the specific update.

Are there any prerequisites for any of the updates offered in this bulletin for affected editions of Microsoft Lync 2013 (Skype for Business)? Yes. Customers running affected editions of Microsoft Lync 2013 (Skype for Business) must first install the 2965218 update for Office 2013 released in April 2015, and then the 3039779 security update released in May 2015. For more information about these two prerequisite updates, see:

Knowledge Base Article 2965218              Knowledge Base Article 3039779             

Are there any related non-security updates that customers should install along with the Microsoft Live Meeting Console security update? Yes, in addition to releasing a security update for Microsoft Live Meeting Console, Microsoft has released the following non-security updates for the OCS Conferencing Addin for Outlook. Where applicable, Microsoft recommends that customers install these updates to keep their systems up-to-date:

OCS Conferencing Addin for Outlook (32-bit) (3189648) OCS Conferencing Addin for Outlook (64-bit) (3189648)

See Microsoft Knowledge Base Article 3189648 for more information.

Why is the Lync 2010 Attendee (user level install) update only available from the Microsoft Download Center? Microsoft is releasing the update for Lync 2010 Attendee (user level install) to the Microsoft Download Center only. Because the user level installation of Lync 2010 Attendee is handled through a Lync session, distribution methods such as automatic updating are not appropriate for this type of installation scenario.