New Vulnerability Affecting SQL Server 2008, 2008 R2, 2012, and 2014

It's Patch Tuesday, and the last time there was a security vulnerability with direct SQL Server implications was in August. Today Microsoft released Security Bulletin MS15-058 (and KB #3065718), which has both GDR and QFE updates for all supported branches of SQL Server, and even a couple of unsupported branches. I wanted to post a quick table so you can see which one you should apply, and why.

As a note, GDR updates (GDR = "General Distribution Release") are those you apply to instances where you don't want all of the fixes and enhancements that have been offered in Cumulative Updates. If you want those fixes, you should take the QFE update instead (QFE = "Quick Fix Engineering"). You can see a more detailed explanation of the differences here.

Also, note that SQL Server 2014 Service Pack 1 was not affected by the security vulnerability, but a GDR fix was pushed out to address a separate issue with Columnstore indexes (see KB #3067257).

Also, since the security release last week, a new Cumulative Update (#7, 11.0.5623) has been released for SQL Server 2012 Service Pack 2, so if you are not sticking to the GDR branch there, you should install the Cumulative Update (which has 38 total fixes) rather than the security fix on its own.

Finally, in general, I'm always going to recommend that you go to the QFE rather than GDR, and that you move to the most recent Service Pack branch as quickly as possible. However, I understand that sometimes regression testing, waiting for catch-up of CU fixes, or even bugs (cough cough 2014 SP1 CU1 cough cough) can sometimes delay that. On the GDR rows, I'm recommending the GDR fix only for cases where moving to the QFE or a later service pack / CU is not practical.

For more details on individual builds available, at least for SQL Server 2012 and SQL Server 2014, see these blog posts:

• Latest Builds of SQL Server 2012
• Latest Builds of SQL Server 2014

Also, I've had a couple of questions asking about 2008 SP4 and 2008 R2 SP3; specifically, why there are separate GDR and QFE paths. This is kind of confusing, because these two paths exist so that you can choose whether or not to take non-security hotfixes, which are typically released via Cumulative Updates; there have been no CUs for 2008 SP4 or 2008 R2 SP3. However, there have been a couple of critical on-demand (COD) hotfixes released, which I documented here: