Visual Studio Icon Visual Studio 2017 版本 15.9 发行说明Visual Studio 2017 version 15.9 Release Notes

| 开发者社区 | 系统要求 | 兼容性 | 可分发代码 | 许可条款 | 博客 | 已知问题 || Developer Community | System Requirements | Compatibility | Distributable Code | License Terms | Blogs | Known Issues |

单击按钮即可下载最新版 Visual Studio 2017。Click a button to download the latest version of Visual Studio 2017. 有关如何安装和更新 Visual Studio 2017 的说明，请参阅将 Visual Studio 2017 更新到最新版本。For instructions on installing and updating Visual Studio 2017, see Update Visual Studio 2017 to the most recent release. 另请参阅如何脱机安装的说明。Also, see instructions on how to install offline.

请访问 visualstudio.com/downloads 页面，下载其他 Visual Studio 2017 产品。Visit the visualstudio.com/downloads page to download other Visual Studio 2017 products.

15.9 中的新增功能What's New in 15.9

Visual Studio 2017 版本 15.9 发布Visual Studio 2017 version 15.9 Releases

重要

Visual Studio 2017 版本 15.9 安全公告通知Visual Studio 2017 version 15.9 Security Advisory Notices

Release Notes Icon Visual Studio 2017 版本 15.9.9Visual Studio 2017 version 15.9.9 New Release icon

发布时间：2019 年 3 月 12 日released on March 12, 2019

15.9.9 版中新增功能的详细信息Details of What's New in 15.9.9

15.9.9 版中修复的问题Issues Fixed in 15.9.9

15.9.9 版中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.9:

安全公告通知Security Advisory Notices

Release Notes Icon Visual Studio 2017 版本 15.9.8Visual Studio 2017 version 15.9.8

发布时间：2019 年 3 月 5 日released on March 05, 2019

15.9.8 版中新增功能的详细信息Details of What's New in 15.9.8

15.9.8 版中修复的问题Issues Fixed in 15.9.8

15.9.8 版中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.8:

Release Notes Icon Visual Studio 2017 版本 15.9.7Visual Studio 2017 version 15.9.7

发布日期：2019 年 2 月 12 日released on February 12, 2019

15.9.7 版中修复的问题Issues Fixed in 15.9.7

15.9.7 版中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.7:

安全公告通知Security Advisory Notices

Release Notes Icon Visual Studio 2017 版本 15.9.6Visual Studio 2017 version 15.9.6

发布日期：2019 年 1 月 24 日released on January 24, 2019

15.9.6 中修复的问题Issues Fixed in 15.9.6

15.9.6 版中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.6:

Release Notes Icon Visual Studio 2017 版本 15.9.5Visual Studio 2017 version 15.9.5

发布日期：2019 年 1 月 8 日released on January 08, 2019

15.9.5 中修复的问题Issues Fixed in 15.9.5

15.9.5 版中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.5:

安全公告通知Security Advisory Notices

Release Notes Icon Visual Studio 2017 版本 15.9.4Visual Studio 2017 version 15.9.4

发布时间：2018 年 12 月 11 日released on December 11, 2018

15.9.4 中修复的问题Issues Fixed in 15.9.4

15.9.4 中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.4:

安全公告通知Security Advisory Notices

Release Notes Icon Visual Studio 2017 版本 15.9.3Visual Studio 2017 version 15.9.3

发布日期：2018 年 11 月 28 日released on November 28, 2018

15.9.3 中修复的问题Issues Fixed in 15.9.3

15.9.3 版中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.3:

Release Notes Icon Visual Studio 2017 版本 15.9.2Visual Studio 2017 version 15.9.2

发布日期：2018 年 11 月 19 日released on November 19, 2018

15.9.2 中修复的问题Issues Fixed in 15.9.2

15.9.2 版中解决了客户报告的下列问题：These are the customer-reported issues addressed in 15.9.2:

Release Notes Icon Visual Studio 2017 版本 15.9.1Visual Studio 2017 version 15.9.1

发布日期：2018 年 11 月 15 日released on November 15, 2018

15.9.1 中修复的问题Issues Fixed in 15.9.1

以下问题已在 15.9.1 版中得到解决：These are the issues addressed in 15.9.1:

  • 修复了以下 bug：使用 Microsoft Xbox One XDK 时，Visual Studio 无法生成项目。Fixed a bug where Visual Studio would fail to build projects using the Microsoft Xbox One XDK.

15.9.1 版中新增功能的详细信息Details of What's New in 15.9.1

通用 Windows 平台开发 SDKUniversal Windows Platform Development SDK

Windows 10 2018 年 10 月更新 SDK - 内部版本 17763 现在是通用 Windows 平台开发工作负载所选的默认 SDK。The Windows 10 October 2018 Update SDK (build 17763) is now the default selected SDK for the Universal Windows Platform development workload.

15.9 版中的主要新增功能摘要Summary of Notable New Features in 15.9

15.9 版中解决的首要问题Top Issues Fixed in 15.9

请参阅 Visual Studio 2017 15.9 版中已解决的客户所报所有问题。See all customer-reported issues fixed in Visual Studio 2017 version 15.9.

The Developer Community Portal

15.9 版中新增功能的详细信息Details of What's New in 15.9

Release Notes Icon Visual Studio 2017 版本 15.9.0Visual Studio 2017 version 15.9.0

发布日期：2018 年 11 月 13 日released on November 13, 2018

15.9 版中的新增功能New Features in 15.9

安装Install

我们让你能够更为轻松地跨 Visual Studio 的多个安装来保持安装设置的一致性。We made it easier to keep your installation settings consistent across multiple installations of Visual Studio. 你现在可以使用 Visual Studio 安装程序为给定的 Visual Studio 实例导出 .vsconfig 文件。You can now use the Visual Studio Installer to export a .vsconfig file for a given instance of Visual Studio. 此文件将包含有关你已安装的工作负载和组件的信息。This file will contain information about what workloads and components you have installed. 然后，可以导入此文件，以将这些工作负载和组件选项添加到 Visual Studio 的其他安装中。You can then import this file to add these workload and component selections to another installation of Visual Studio.

调试Debugging

已支持使用基于可移植 pdb 的新符号包格式 (.snupkg)。We have added support for consuming the new portable-pdb based symbol package format (.snupkg). 添加了工具，使你可从 NuGet.org 符号服务器等源轻松使用和管理符号包。We have added tooling to make it easy to consume and manage these symbol packages from sources like the NuGet.org symbol server.

C++C++

  • 我们在 Visual Studio Enterprise 版本的适用于 C++ 的调试器中添加了“后退”功能。We've added the "step back" feature in the debugger for C++ in the Visual Studio Enterprise Edition. 后退功能使你能够及时返回，以及时查看之前的应用程序的状态。Step back enables you to go back in time to view the state of your application at a previous point in time.
  • C++ IntelliSense 现响应面向 Linux 的 CMake 和 MSBuild 项目的远程环境中的更改。C++ IntelliSense now responds to changes in the remote environment for both CMake and MSBuild projects targeting Linux. 安装新的库或更改 CMake 项目时，C++ IntelliSense 将自动分析远程计算机上的新头文件，以实现完整无缝的 C++ 编辑体验。As you install new libraries or change your CMake projects, C++ IntelliSense will automatically parse the new headers files on the remote machine for a complete and seamless C++ editing experience.
  • 已将 UWP Desktop Bridge 框架包更新至 Windows 应用商店的最新版本，适用于包括 ARM64 在内的所有受支持的体系结构。We've updated the UWP Desktop Bridge framework packages to match the latest in the Windows Store for all supported architectures, including ARM64.
  • 除修复了 60 个阻止性 bug 外，还添加了对 range-v3 库和 MSVC 15.9 编译器配合使用的支持，在 /std:c++17 /permissive- 下提供。In addition to fixing 60 blocking bugs, we have added support for the range-v3 library with the MSVC 15.9 compiler, available under /std:c++17 /permissive-.
  • Visual Studio 中的零售 VCLibs 框架包已更新至 UWP 应用商店中的最新版。The retail VCLibs framework package in Visual Studio has been updated to match the latest available version in the UWP Store.
  • 现已完全支持 ARM64 C++ 本机桌面方案（包括 VC++ 2017 可再发行版）。Full support is now available for ARM64 C++ Native Desktop scenarios, including VC++ 2017 Redistributable.
  • 我们在 C++ 17 的 charconv 标头中实现了浮点 to_chars() 的最短往返程十进制重载。We implemented the shortest round-trip decimal overloads of floating-point to_chars() in C++17's charconv header. 使用科学记数法，约是 sprintf_s() "%.8e" 的 10 倍快（对于单精度浮点），是 sprintf_s() "%.16e" 的 30 倍快（对于双精度浮点）。For scientific notation, it is approximately 10x as fast as sprintf_s() "%.8e" for floats, and 30x as fast as sprintf_s() "%.16e" for doubles. 这使用 Ulf Adams 新算法 - Ryu。This uses Ulf Adams' new algorithm, Ryu.
  • 对 Visual C++ 编译器的标准符合性进行了一系列改进，标准符合性可能要求在严格符合性模式下进行源更改，可在此处找到这一系列改进。A list of improvements to the standards conformance of the Visual C++ compiler, which potentially require source changes in strict conformance mode, can be found here.
  • 我们已弃用 C++ 编译器 /Gm 交换机。We have deprecated the C++ Compiler /Gm switch. 如果已显式定义，请考虑在生成脚本中禁用 /Gm 交换机。Consider disabling the /Gm switch in your build scripts if it's explicitly defined. 或者，也可以安全地忽略针对 /Gm 的弃用警告，因为在使用“将警告视为错误”(/WX) 时不会将其视为错误。Alternatively, you can also safely ignore the deprecation warning for /Gm as it will not be treated as error when using "Treat warnings as errors" (/WX).

F#F#

F# 编译器F# Compiler

  • 我们修复了采用 byref 值的扩展方法可能转变不可变值的 bug。We fixed a bug where extension methods that take byref values could mutate an immutable value.
  • 改进了 byref/inref/outref 上的重载的编译错误信息，而非显示以前模糊的错误。We improved the compile error information for overloads on byref/inref/outref, rather than displaying the previously obscure error.
  • 现已完全不允许使用 byref 上的可选类型扩展。Optional Type Extensions on byrefs are now disallowed entirely. 之前可以声明它们，但无法使用，从而令客户困惑。They could be declared previously, but were unusable, resulting in a confusing user experience.
  • 修复了在结构元组上使用 CompareTo 并产生使用别名的结构元组的类型等效项而造成运行时异常的 bug。We fixed a bug where CompareTo on a struct tuple and causing a type equivalence with an aliased struct tuple would result in a runtime exception.
  • 修复了在创作适用于 .NET Standard 的类型提供程序时使用 System.Void 可能无法在设计时查找 System.Void 类型的 bug。We fixed a bug where use of System.Void in the context of authoring a Type Provider for .NET Standard could fail to find the System.Void type at design-time.
  • 修复了部分应用的可区分联合构造函数不匹配可区分联合的带批注或推论出的类型时可能发生内部错误的 bug。We fixed a bug where an internal error could occur when a partially applied Discriminated Union constructor is mismatched with an annotated or inferred type for the Discriminated Union.
  • 修改了尝试采用表达式（如访问属性）寻址时的编译器错误消息，以更清楚地表达其违反了 byref 类型的范围规则。We modified the compiler error message when attempting to take an address of an expression (such as accessing a property) to make it more clear that it violates scoping rules for byref types.
  • 修复了对方法或函数部分应用 byref 类型时程序可能在运行时崩溃的 bug。We fixed a bug where your program could crash at runtime when partially applying a byref type to a method or function. 现在会显示一条错误消息。An error message will now display.
  • 修复了 byref 和引用类型（例如 byref<int> option）的无效组合会在运行时失败且不发出错误消息的问题。We fixed an issue where an invalid combination of a byref and a reference type (such as byref<int> option) would fail at runtime and not emit an error message. 现在可发出错误消息。We now emit an error message.

F# 工具F# Tools

  • 解决了使用 .NET Core SDK 生成的 F# 程序集元数据不在 Windows 的文件属性中显示的问题。We resolved an issue where metadata for F# assemblies built with the .NET Core SDK was not shown in file properties on Windows. 现在，右键单击 Windows 上的程序集并选择“属性”即可查看此元数据。You can now see this metadata by right-clicking an assembly on Windows and selecting Properties.
  • 修复了在 F# 源中使用 module global 可能导致 Visual Studio 不响应的 bug。We fixed a bug where use of module global in F# source could cause Visual Studio to become unresponsive.
  • 修复了使用 inref<'T> 的扩展方法在完成列表中不显示的 bug。We fixed a bug where extension methods using inref<'T> would not show in completion lists.
  • 修复了 .NET Framework F# 项目的“项目属性”中 TargetFramework 下拉列表为空的 bug。We fixed a bug where the TargetFramework dropdown in Project Properties for .NET Framework F# projects was empty.
  • 修复了创建面向 .NET Framework 4.0 的新 F# 项目将失败的 bug。We fixed a bug where creating a new F# project targeting .NET Framework 4.0 would fail.

F# 开源存储库F# Open Source Repository

现将 VisualFSharpFull 项目设为默认启动项目，使你无需在调试前进行手动设置。The VisualFSharpFull project is now set as the default startup project, eliminating the need to manually set that before debugging. 谢谢你，Robert Jeppesen！Thanks, Robert Jeppesen!

JavaScript 和 TypeScript 语言服务支持JavaScript and TypeScript Language Service Support

  • 我们添加了重构，以在文件被重命名后修复该文件的引用。We added refactoring to fix up references to a file after it has been renamed. 我们还添加了对项目引用的支持，使你能够将你的 TypeScript 项目拆分为相互引用的独立版本。We also added support for project references, letting you split your TypeScript project up into separate builds that reference each other.
  • 我们已更新到最新的 Vue CLI 3.0 并改进了 Vue.js 模板文件中的 linting。We updated to the latest Vue CLI 3.0 and improved linting in Vue.js template files. 你也可以使用 Jest 框架来编写和运行单元测试。You can also write and run unit tests using the Jest framework.
  • 添加了对 TypeScript 3.1 的支持。We have added support for TypeScript 3.1.

SharePoint 2019 支持SharePoint 2019 Support

我们添加了可以实现为 SharePoint 2019 创建项目的新模板。We added new templates that allow you to create projects for SharePoint 2019. 我们能够将现有 SharePoint 项目从 SharePoint 2013 和 SharePoint 2016 迁移到新的项目模板。You will have the ability to migrate existing SharePoint projects from both SharePoint 2013 and SharePoint 2016 to the new project template.

Visual Studio Tools for XamarinVisual Studio Tools for Xamarin

Visual Studio Tools for Xamarin 现支持 Xcode 10，这使你可为 iOS 12、tvOS 12 和 watchOS 5 生成和调试应用。Visual Studio Tools for Xamarin now supports Xcode 10, which allows you to build and debug apps for iOS 12, tvOS 12, and watchOS 5. 有关可用新功能的更多详细信息，请参阅使用 iOS 12 的准备工作和我们对 iOS 12 的介绍。See how to get ready for iOS 12and our introduction to iOS 12for more details on the new features available.

初始 Xamarin.Android 生成性能改进Initial Xamarin.Android Build Performance Improvements

Xamarin.Android 9.1 包括初始生成性能改进。Xamarin.Android 9.1 includes initial build performance improvements. 请参阅我们的 Xamarin.Android 15.8 和15.9 生成性能比较以了解详细信息。See our Xamarin.Android 15.8 vs. 15.9 build performance comparison for more details.

适用于通用 Windows 平台开发的工具Tools for Universal Windows Platform Developers

  • 最新的 Windows 10 SDK（版本 17763）作为通用 Windows 平台开发工作负荷中的可选组件包括进来。The latest Windows 10 SDK (build 17763) is included as an optional component in the Universal Windows Platform development Workload.
  • 我们为通用 Windows 平台项目添加了对创建 .MSIX 包的支持，也在 Windows 应用程序打包项目模板中添加了此支持。We added support for creating .MSIX packages for both the Universal Windows Platform projects, as well as in the Windows Application Packaging Project template. 若要创建 .MSIX 包，应用程序的最低版本必须为最新的 Windows 10 SDK（内部版本 17763）。To create an .MSIX package, the minimum version of your application must be the latest Windows 10 SDK (build 17763).
  • 你现在可以构建 ARM64 UWP 应用程序。You can now build ARM64 UWP applications. 对于.NET UWP 应用程序，仅 .NET Native 支持 ARM64，并且必须将应用程序的最低版本设置为 Fall Creators Update（版本 16299）或更高版本。For .NET UWP applications, only .NET Native is supported for ARM64, and you must set the Minimum Version of your application to the Fall Creators Update (Build 16299) or higher.
  • 我们为通用 Windows 平台应用程序的 F5（生成 + 部署）速度进行了改进。We made improvements to the F5 (Build + Deploy) speed for Universal Windows Platform applications. 这一改进对于使用 Windows 身份验证部署到远程目标的操作将更为明显，但也会影响所有其他部署。This will be most noticeable for deployments to remote targets using Windows authentication, but will impact all other deployments as well.
  • 开发人员现在可以选择在使用 XAML 设计器时指定控件显示选项，同时生成面向 Windows 10 Fall Creators Update（内部版本 16299）或更高版本的 UWP 应用程序。Developers now have the option to specify Control Display Options when using the XAML Designer while building UWP applications targeting the Windows 10 Fall Creators Update (build 16299) or later. 选择“仅显示平台控件”可阻止设计器执行任何自定义控制代码，以提升设计器的可靠性。Selecting "Only Display Platform Controls" prevents the designer from executing any custom control code to improve reliability of the designer.
  • XAML 设计器现可自动将引发可捕获异常的控件替换为回退控件，而非出现设计器崩溃。The XAML designer now automatically replaces controls that throw with catchable exceptions with fallback controls, rather than having the designer crash. 回退控件具有黄色边框，以提示开发人员控件已在设计时被替换。Fallback controls have a yellow border to cue in developers that the control has been replaced at design time.
  • Windows 应用程序打包项目现支持使用 Core CLR 调试器类型调试后台进程。The Windows Application Packaging project now supports debugging background process using the Core CLR debugger type.

NuGetNuGet

NuGet 凭据提供程序改进NuGet Credential Provider Improvements

此版本显著改善了使用已经过身份验证的包源的体验，尤其适用于 Mac 和 Linux 用户：This release substantially improves the experience of using authenticated package feeds, especially for Mac and Linux users:

  • Visual Studio、MSBuild、NuGet.exe 和 .NET 现在支持新的凭据提供程序插件接口，可以通过 Azure Artifacts 等专用包主机实现。Visual Studio, MSBuild, NuGet.exe, and .NET now support a new Credential Provider plugin interface, which can be implemented by private package hosts like Azure Artifacts. 以前，只有 NuGet.exe 和 Visual Studio 接受凭据提供程序。Previously, only NuGet.exe and Visual Studio accepted Credential Providers.
  • Visual Studio 版本（包括生成工具版本）现提供具有特定工作负荷的 Azure Artifacts 凭据提供程序，从而可在开发过程中轻松使用 Azure Artifacts 源。Visual Studio editions (including the Build Tools edition) now deliver the Azure Artifacts Credential Provider with certain workloads, so that you can easily use Azure Artifacts feeds in the course of your development. 要使用这些改进的功能，请安装 NuGet 包管理器或 NuGet 目标和生成任务组件，或 .NET Core 工作负载。To use these improvements, install the NuGet package manager or NuGet targets and build tasks components, or the .NET Core workload.

NuGet 包管理器改进NuGet Package Manager Improvements

  • NuGet 现在支持对基于 PackageReference 的项目锁定完全包封闭，因此可支持包的重复还原。NuGet now enables locking the full package closure of PackageReference based projects, thereby enabling repeatable restore of packages.
  • Visual Studio NuGet 包管理器用户界面现在显示使用新许可证格式的包的许可证信息。The Visual Studio NuGet package manager UI now surfaces the license information for packages that use the new license format. 新许可证格式以 SPDX 表达式或许可证文件的形式嵌入许可证信息作为包的一部分。The new license format embeds the license information as part of the package in the form of an SPDX expression or a license file.

NuGet 安全性NuGet Security

我们引入了 NuGet 客户端策略，使你能够配置包安全性约束。We have introduced NuGet Client Policies which allow you to configure package security constraints. 这意味着你可以锁定环境以仅允许安装信任的包，方法如下：This means you can lock down environments so only trusted packages can be installed by:

  • 不允许安装未签名的包。Disallowing the installation of unsigned packages.
  • 根据创建者签名定义一系列信任的签名者。Defining a list of trusted signers based on the author signature.
  • 根据存储库签名中的元数据，定义一系列信任的 NuGet.org 包所有者。Defining a list of trusted NuGet.org package owners based on the metadata in the repository signature.

用于 Visual Studio 的 .NET Core 工具.NET Core Tools for Visual Studio

从此版本开始，用于 Visual Studio 的 .NET Core 工具现将默认为仅使用最新稳定版本的 .NET Core SDK，它安装于 Visual Studio 公开发行版的计算机上。Starting with this release, the .NET Core tools for Visual Studio will now default to using only the latest stable version of a .NET Core SDK that is installed on your machine for GA releases of Visual Studio. 对于将来的预览版，工具将仅使用预览版 .NET Core SDK。For future previews, the tools will use only preview .NET Core SDKs.

Release Notes Icon Visual Studio 2017 版本 15.9 安全公告通知Visual Studio 2017 version 15.9 Security Advisory Notices

Visual Studio 2017 版本 15.9.9 服务发布 -- 发布时间：2019 年 3 月 12 日Visual Studio 2017 version 15.9.9 Service Release -- released on March 12, 2019

CVE-2019-0809 Visual Studio 远程代码执行漏洞CVE-2019-0809 Visual Studio Remote Code Execution Vulnerability

Visual Studio C++ Redistributable 安装程序在加载动态链接库 (DLL) 之前错误验证输入时，存在远程代码执行漏洞。A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files. 成功利用此漏洞的攻击者可能会在当前用户的上下文中执行任意代码。An attacker who successfully exploited the vulnerability could execute arbitrary code in the context of the current user. 与使用管理用户权限操作的用户相比，其帐户在系统上具有更少用户权限的用户更不易受到影响。Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. 要利用该漏洞，攻击者必须在本地系统上放置一个恶意 DLL 并说服用户执行特定可执行文件。To exploit the vulnerability, an attacker must place a malicious DLL on a local system and convince a user to execute a specific executable. 该安全更新处理了该项漏洞，它更正了 Studio C++ Redistributable 安装程序在加载 DLL 文件前验证输入的方式。The security update addresses the vulnerability by correcting how the Visual Studio C++ Redistributable Installer validates input before loading DLL files.

CVE-2019-9197 Unity 编辑器远程代码执行漏洞CVE-2019-9197 Unity Editor Remote Code Execution Vulnerability

Unity 编辑器中存在远程代码执行漏洞，该编辑器是 Visual Studio 提供的第三方软件，用于在向 Unity 工作负载进行游戏部署时安装。A remote code execution vulnerability exists in the Unity Editor, a 3rd party software that Visual Studio offers to install as part of the Game Development with Unity workload. 如果已安装来自 Visual Studio 的 Unity，请务必将你在使用的 Unity 版本上传到处理 CVE 中所述漏洞的版本。If you've installed Unity from Visual Studio, please make sure to update the version of Unity you're using to a version that addresses the vulnerability as described in the CVE. Visual Studio 安装程序已更新，可提供安装能处理该漏洞的 Unity 编辑器版本。The Visual Studio installer has been updated to offer to install a Unity Editor version which addresses the vulnerability.

CVE-2019-0757 .NET Core NuGet 篡改漏洞CVE-2019-0757 .NET Core NuGet Tampering Vulnerability

在 Linux 或 Mac 环境中执行时，NuGet 软件中存在篡改漏洞。A tampering vulnerability exists in NuGet software when executed in a Linux or Mac environment. 成功利用此漏洞的攻击者可能会在当前用户的上下文中运行任意代码。An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. 如果当前用户使用管理用户权限登录，则攻击者可能会控制受影响的系统。If the current user is logged on with administrative user rights, an attacker could take control of the affected system. 然后，攻击者可能会安装程序、查看更改项或删除数据，还可能会使用完全用户权限创建新的帐户。An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. 与使用管理用户权限操作的用户相比，其帐户在系统上具有更少用户权限的用户更不易受到影响。Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. 要利用此漏洞，攻击者必须能够以该计算机上任意其他用户的身份登录。Exploitation of the vulnerability requires that an attacker can login as any other user on that machine. 此时，攻击者将能够替换或添加到当前用户帐户中由 NuGet 还原操作创建的文件。At that point, the attacker will be able to replace or add to files that were created by a NuGet restore operation in the current users account.

今天已发布 .NET Core 更新，包含在此 Visual Studio 更新中。.NET Core updates have released today and are included in this Visual Studio update. 该安全更新处理了该项漏洞，它更正了 NuGet 还原为提取到客户端计算机上的所有文件创建文件权限的方式。The security update addresses the vulnerability by correcting how NuGet restore creates file permissions for all files extracted to the client machine. 有关包的详细信息，请参阅 .NET Core 发行说明。Details about the packages can be found in the .NET Core release notes.

Visual Studio 2017 版本 15.9.7 服务版本 - 发布于 2019 年 2 月 12 日Visual Studio 2017 version 15.9.7 Service Release -- released on February 12, 2019

CVE-2019-0613 WorkflowDesigner XOML 反序列化允许代码执行CVE-2019-0613 WorkflowDesigner XOML deserialization allows code execution

引用特定类型的 XOML 文件可能导致在 Visual Studio 中打开 XOML 文件时执行任意代码。A XOML file referencing certain types could cause random code to be executed when the XOML file is opened in Visual Studio. 现在允许在 XOML 文件中使用的类型具有一定限制。There is now a restriction on what types are allowed to be used in XOML files. 如果打开包含最新未经授权的类型之一的 XOML 文件，将显示一条消息，说明该类型未经授权。If a XOML file containing one of the newly unauthorized types is opened, a message is displayed explaining that the type is unauthorized.

如果已知所打开的 XOML 文件不会导致安全问题，可以通过将项添加到 devenv.exe.config 文件的 <appSettings> 部分来禁用对未经授权的类型的检查，如下所示：If it is known that the XOML file being opened does not cause security issues, you can disable the check for unauthorized types by adding a key to the <appSettings> section of the devenv.exe.config file as follows:

<appSettings>
  <add key="microsoft:WorkflowComponentModel:DisableXOMLSerializerTypeChecking" value="true"/>
</appSettings>

此 appSetting 值可完全禁用 XOML 序列化程序中的类型检查。This appSetting value completely disables the type checking in the XOML serializer. 如果此值为“true”，则优先于其他新的 appSetting。If this value is "true", it takes precedence over the other new appSetting.

如果只想禁用几个特定类型，但允许其他所有类型，则需要对 devenv.exe.config 文件进行以下更改：If you only want to disallow a few specific types, but allow all other types, your need to make the following changes to your devenv.exe.config file:

<appSettings>
  <add key="microsoft:WorkflowComponentModel:DisableXOMLSerializerDefaultUnauthorizedTypes" value="true"/>
</appSettings>

这将允许所有类型都默认为未经授权。This will allow all of the types are were unauthorized by default. 要将特定类型标记为未经授权，还必须将这些更改添加到 devenv.exe.config 文件：To mark specific types as unauthorized you must also add these changes to the devenv.exe.config file:

<configuration>
...
  <configSections>
    <sectionGroup name="System.Workflow.ComponentModel.WorkflowCompiler" type="System.Workflow.ComponentModel.Compiler.WorkflowCompilerConfigurationSectionGroup, System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
      <section name="authorizedTypes" type="System.Workflow.ComponentModel.Compiler.AuthorizedTypesSectionHandler, System.Workflow.ComponentModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
    </sectionGroup>
  </configSections>
...
  <System.Workflow.ComponentModel.WorkflowCompiler>
    <authorizedTypes>
      <foo version="v4.0">
        <authorizedType Assembly="System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" Namespace="System.Activities.Presentation" TypeName="WorkflowDesigner" Authorized="false"/>
      </foo>
    </authorizedTypes>
  </System.Workflow.ComponentModel.WorkflowCompiler>
...
</configuration>

上述更改只会将程序集 System.Activities.Presentation (Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35) 中的 System.Activities.Presentation.WorkflowDesigner 类型标记为未经授权。The above changes will only mark the type System.Activities.Presentation.WorkflowDesigner in the assembly System.Activities.Presentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 as unauthorized. 要将其他类型标记为未经授权，请为这些其他类型添加相似的条目。To mark other types as unauthorized add similar entries for those other types.

CVE-2019-0657 .NET Framework 和 Visual Studio 欺骗漏洞CVE-2019-0657 .NET Framework and Visual Studio Spoofing Vulnerability

今天已发布 .NET Core 更新，包含在此 Visual Studio 更新中。.NET Core updates have released today and are included in this Visual Studio update. 此版本解决了安全性和其他重要问题。This release addresses security and other important issues. 有关详细信息，请参阅 .NET Core 发行说明。Details can be found in the .NET Core release notes.

Visual Studio 2017 版本 15.9.5 服务版本 - 发布于 2018 年 1 月 8 日Visual Studio 2017 version 15.9.5 Service Release -- released on January 08, 2018

CVE-2019-0546 Visual Studio 远程代码执行漏洞CVE-2019-0546 Visual Studio Remote Code Execution Vulnerability

当 C++ 编译器对特定 C++ 构造组合处理不当时，Visual Studio 中会出现远程代码执行漏洞。A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs. 成功利用此漏洞的攻击者可能会在当前用户的上下文中运行任意代码。An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. 如果当前用户使用管理用户权限登录，则攻击者可能会控制受影响的系统。If the current user is logged on with administrative user rights, an attacker could take control of the affected system. 然后，攻击者可能会安装程序、查看更改项或删除数据，还可能会使用完全用户权限创建新的帐户。An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. 与使用管理用户权限操作的用户相比，其帐户在系统上具有更少用户权限的用户更不易受到影响。Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. 本次安全更新通过更正 Visual Studio C++ 编译器处理某些 C++ 构造的方式来解决该漏洞。The security update addresses the vulnerability by correcting how the Visual Studio C++ compiler handles certain C++ constructs.

Visual Studio 2017 版本 15.9.4 服务发布 -- 发布时间：2018 年 12 月 11 日Visual Studio 2017 version 15.9.4 Service Release -- released on December 11, 2018

CVE-2018-8599 诊断中心标准收集器服务特权提升漏洞CVE-2018-8599 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

如果诊断中心标准收集器服务不正确地处理特定文件操作，就会存在特权提升漏洞。An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles certain file operations. 成功利用此漏洞的攻击者可以获得提升的权限。An attacker who successfully exploited this vulnerability could gain elevated privileges. 攻击者必须对易受攻击的系统拥有非特权访问权限，才能利用此漏洞。To exploit this vulnerability, an attacker would require unprivileged access to a vulnerable system. 此安全更新程序解决了这个漏洞，具体是通过确保诊断中心标准收集器服务能够正确模拟文件操作。The security update addresses the vulnerability by ensuring the Diagnostics Hub Standard Collector Services properly impersonates file operations.

已解决的问题Fixed Issues

请参阅 Visual Studio 2017 15.9 版中已解决的客户所报所有问题。See all customer-reported issues fixed in Visual Studio 2017 version 15.9.

The Developer Community Portal

已知问题Known Issues

查看 Visual Studio 2017 版本 15.9 中全部现有已知问题和可用解决办法。See all existing known issues and available workarounds in Visual Studio 2017 version 15.9.

Visual Studio 2017 Known Issues

反馈Feedback

我们期待你的宝贵意见和建议！We would love to hear from you! 如有问题，请通过安装程序或 Visual Studio IDE 右上角的“报告问题”选项告知我们。For issues, let us know through the Report a Problem option in the upper right-hand corner of either the installer or the Visual Studio IDE itself. 必须向The Feedback Icon 图标位于右上角。icon is located in the upper right-hand corner. 可以在 Visual Studio 开发者社区中提出产品建议或跟踪问题，也可在其中提问、寻找答案和建议新功能。You can make a product suggestion or track your issues in the Visual Studio Developer Community, where you can ask questions, find answers, and propose new features. 此外，还可通过实时聊天支持获得免费安装帮助。You can also get free installation help through our Live Chat support.

博客Blogs

通过参考开发人员工具博客网站中的见解和建议，随时掌握所有新版本的最新最全资讯，并发表有关大量功能的深入分析帖子。Take advantage of the insights and recommendations available in the Developer Tools Blogs site to keep you up-to-date on all new releases and include deep dive posts on a broad range of features.

Developer Tools Blogs

Visual Studio 2017 发行说明历史记录Visual Studio 2017 Release Notes History

若要详细了解以往 Visual Studio 2017 版本的相关信息，请参阅 Visual Studio 2017 发行说明历史记录页。For more information relating to past versions of Visual Studio 2017, see the Visual Studio 2017 Release Notes History page.

返回页首
Top of Page