Contact us
Dec 18, 2020

Update - For Visual C++ 2013 Redistributable Package Updated

Sphera Editorial Team

This document is intended for system administrators, software developers, and advanced users who need to understand the specific update (KB3179560) and its implications for application compatibility and security.

Technical White Paper: Update for Visual C++ 2013 Redistributable Package Document ID: VC2013-REDIST-UPD Version: 1.0 Date: October 2023 (Updated reference) 1. Executive Summary The Microsoft Visual C++ 2013 Redistributable Package is a runtime component required to execute applications developed with Visual Studio 2013. Without it, applications compiled with this version of the toolset fail to launch with errors such as "The program can't start because MSVCR120.dll is missing" . The Update (specifically KB3179560 for the x86 and x64 versions) is a critical replacement for the original RTM (Release to Manufacturing) redistributable. This update addresses:

Security vulnerabilities: CVE-2016-3319, CVE-2016-3340, and CVE-2016-3341 (Remote Code Execution via MFC). Reliability fixes: Crashes in specific multithreaded scenarios and improved compatibility with Windows 10 and Windows Server 2016. Deployment improvements: Better side-by-side assembly handling.

Key recommendation: Any system running applications that depend on the original Visual C++ 2013 redistributable should be updated to the KB3179560 version immediately. 2. Background & Naming Convention 2.1 Why “2013”? Visual Studio 2013 (Version 12.0) introduced C++11 features and runtime improvements. The redistributable version is 12.0.40664.0 (or higher after updates). 2.2 Common Confusion with Visual C++ 2015-2022 In 2015, Microsoft unified the C++ runtime into a single redistributable (versions 14.x). However, VC++ 2013 remains separate because of breaking changes in the C++ standard library and ABI (Application Binary Interface). Applications built with VC++ 2013 cannot run on the newer 2015-2022 redistributables. 2.3 The Update vs. The Original | Component | Original RTM | Updated (KB3179560) | |------------|---------------|----------------------| | Version number | 12.0.30501.0 | 12.0.40664.0 | | File msvcr120.dll | 12.0.21005.1 | 12.0.40664.0 | | Security patches | No | Yes (multiple CVEs) | | Windows 10 support | Basic | Full (including Anniversary Update) | 3. Technical Details of the Update 3.1 Update Identification

KB Article: KB3179560 Official Title: “Update for Visual C++ 2013 and Visual C++ Redistributable Package” Release Date: August 9, 2016 (security bulletin MS16-100) Downloadable executables:

vcredist_x86.exe (32-bit) vcredist_x64.exe (64-bit) vcredist_arm.exe (Windows RT/Phone, less common)

3.2 Fixed CVEs (Security)

CVE-2016-3319: Remote Code Execution in MFC – Dialog Editor. CVE-2016-3340: Elevation of Privilege in MFC – CToolTipCtrl. CVE-2016-3341: Information Disclosure in MFC – CDataExchange.

All three could allow an attacker to execute arbitrary code via a specially crafted dialog resource in an MFC application. 3.3 Non-Security Fixes

Resolved a deadlock condition in the Concurrency Runtime ( ConcRT ). Fixed a crash when using std::random_shuffle() on certain data sets. Improved compatibility with Windows 10’s UCRT (Universal C Runtime). Corrected a bug where environment variables were truncated after 127 characters in _putenv_s .

4. Deployment and System Impact 4.1 Installation Behavior

Check for existing version: The installer detects if a newer version is already present. If the RTM version (12.0.30501.0) or an earlier update is found, it upgrades in-place. Side-by-side: The updated version installs alongside VC++ 2005, 2008, 2010, and 2015+ redistributables. Silent install: Use /quiet or /q for unattended deployment.

Update - For Visual C++ 2013 Redistributable Package Updated

This document is intended for system administrators, software developers, and advanced users who need to understand the specific update (KB3179560) and its implications for application compatibility and security.

Technical White Paper: Update for Visual C++ 2013 Redistributable Package Document ID: VC2013-REDIST-UPD Version: 1.0 Date: October 2023 (Updated reference) 1. Executive Summary The Microsoft Visual C++ 2013 Redistributable Package is a runtime component required to execute applications developed with Visual Studio 2013. Without it, applications compiled with this version of the toolset fail to launch with errors such as "The program can't start because MSVCR120.dll is missing" . The Update (specifically KB3179560 for the x86 and x64 versions) is a critical replacement for the original RTM (Release to Manufacturing) redistributable. This update addresses:

Security vulnerabilities: CVE-2016-3319, CVE-2016-3340, and CVE-2016-3341 (Remote Code Execution via MFC). Reliability fixes: Crashes in specific multithreaded scenarios and improved compatibility with Windows 10 and Windows Server 2016. Deployment improvements: Better side-by-side assembly handling.

Key recommendation: Any system running applications that depend on the original Visual C++ 2013 redistributable should be updated to the KB3179560 version immediately. 2. Background & Naming Convention 2.1 Why “2013”? Visual Studio 2013 (Version 12.0) introduced C++11 features and runtime improvements. The redistributable version is 12.0.40664.0 (or higher after updates). 2.2 Common Confusion with Visual C++ 2015-2022 In 2015, Microsoft unified the C++ runtime into a single redistributable (versions 14.x). However, VC++ 2013 remains separate because of breaking changes in the C++ standard library and ABI (Application Binary Interface). Applications built with VC++ 2013 cannot run on the newer 2015-2022 redistributables. 2.3 The Update vs. The Original | Component | Original RTM | Updated (KB3179560) | |------------|---------------|----------------------| | Version number | 12.0.30501.0 | 12.0.40664.0 | | File msvcr120.dll | 12.0.21005.1 | 12.0.40664.0 | | Security patches | No | Yes (multiple CVEs) | | Windows 10 support | Basic | Full (including Anniversary Update) | 3. Technical Details of the Update 3.1 Update Identification update for visual c++ 2013 redistributable package

KB Article: KB3179560 Official Title: “Update for Visual C++ 2013 and Visual C++ Redistributable Package” Release Date: August 9, 2016 (security bulletin MS16-100) Downloadable executables:

vcredist_x86.exe (32-bit) vcredist_x64.exe (64-bit) vcredist_arm.exe (Windows RT/Phone, less common)

3.2 Fixed CVEs (Security)

CVE-2016-3319: Remote Code Execution in MFC – Dialog Editor. CVE-2016-3340: Elevation of Privilege in MFC – CToolTipCtrl. CVE-2016-3341: Information Disclosure in MFC – CDataExchange.

All three could allow an attacker to execute arbitrary code via a specially crafted dialog resource in an MFC application. 3.3 Non-Security Fixes

Resolved a deadlock condition in the Concurrency Runtime ( ConcRT ). Fixed a crash when using std::random_shuffle() on certain data sets. Improved compatibility with Windows 10’s UCRT (Universal C Runtime). Corrected a bug where environment variables were truncated after 127 characters in _putenv_s . Without it, applications compiled with this version of

4. Deployment and System Impact 4.1 Installation Behavior

Check for existing version: The installer detects if a newer version is already present. If the RTM version (12.0.30501.0) or an earlier update is found, it upgrades in-place. Side-by-side: The updated version installs alongside VC++ 2005, 2008, 2010, and 2015+ redistributables. Silent install: Use /quiet or /q for unattended deployment.

×
site logo