Installing 1912 LTSR CU2 Studio or Scout installs below unsupported Microsoft Visual C++ 2010 Redistributable Binaries

C:\windows\System32\msvcp100.dll
C:\windows\System32\msvcr100.dll
C:\windows\sysWOW64\msvcp100.dll
C:\windows\sysWOW64\msvcr100.dll

Customer has vulnerability scanning in place which identifies the files as vulnerable, after which installs Microsoft KB2565063, which installs full Microsoft Visual Studio C++ 2010 Redistributable.

  

Customer does not want Citrix to install Microsoft Visual Studio C++ 2010 Redistributable binaries as it is no longer supported by Microsoft and is flagged as vulnerability during their security scans.
 

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

The workaround is to install the security update for Microsoft Visual C++ 2010 Redistributable (https://www.catalog.update.microsoft.com/Search.aspx?q=kb2565063) which should update the binaries or replace the old binaries with the one downloaded by this package.

Our Product team is working internally under CVADHELP-17312 to address this issue most likely in 1912 LTSR CU4 where Citrix components will install the latest version of SQLSysClrTypes.

---

Problem Cause

As per inhouse testing it was found that some of 1912 LTSR CU2 components download older version 11.2.5058.0 i of SQLSysClrTypes(x64) and SQLSysClrTypes(x86) which in turn install older Microsoft Visual C++ 2010 Redistributable Binaries even if latest version of Microsoft Visual C++ Redistributable is explicitly installed before Studio/Scout installation.