Aggregated bug-fixes for 7.6.3
Last Update: 2026-08-25
Patch Release 6293 (2024-07-04)
Shipped Components and Versions
- Open-Xchange App Suite backend 7.6.3-rev74
Fixed Bugs
MWB-2639 Mail body partially displayed in webmail
Don’t filter “w:sdt” elements during sanitizing.
Patch Release 6288 (2024-06-14)
Shipped Components and Versions
- Open-Xchange App Suite backend 7.6.3-rev73
- Open-Xchange App Suite office-web 7.6.3-rev7
Fixed Vulnerabilities
Patch Release 5910 (2020-11-24)
Shipped Components and Versions
- Open-Xchange onmobile 7.6.3-rev12
Fixed Bugs
ONM-2 increase of threads since update to 7.6.3-52_53
Response may not be closed/consumed.Always close the response. This closes the low level apache connection, too.
ONM-1 Optimize contact fetching
No connection pool and possible too many results in the response.Reduce resultset by adding a filter (not in trash) and use a global connection pool.
Patch Release 5637 (2020-03-09)
Shipped Components and Versions
- Open-Xchange App Suite backend 7.6.3-rev50
Fixed Vulnerabilities
MWB-34 CVE-2020-8543
CVSS: 3.1
68441 CVE-2019-18846
CVSS: 5.0
Fixed Bugs
MWB-116 OOM, backend/hazelcast crashes frequently
Many unnecessary cache invalidation events related to “User” cache region due to recording the time stamp of last login.This has been solved by only updating user attribute if it actually was changed, skip cluster-wide invalidation.
Patch Release 5537 (2020-01-14)
Shipped Components and Versions
- Open-Xchange App Suite backend 7.6.3-rev49
- Open-Xchange App Suite frontend 7.6.3-rev43
Fixed Vulnerabilities
68258 CVE-2019-18846
CVSS: 5.0
67980 CVE-2019-18846
CVSS: 5.0
67874 CVE-2019-18846
CVSS: 5.0
67871 CVE-2019-18846
CVSS: 6.5
Fixed Bugs
54262 No timeout message if loading modules fails
This has been fixed by adding further check for correct require error.
Patch Release 5537 (2020-01-14)
Shipped Components and Versions
- Open-Xchange App Suite backend 7.6.3-rev49
- Open-Xchange App Suite frontend 7.6.3-rev43
Fixed Vulnerabilities
68258 CVE-2019-18846
CVSS: 5.0
67980 CVE-2019-18846
CVSS: 5.0
67874 CVE-2019-18846
CVSS: 5.0
67871 CVE-2019-18846
CVSS: 6.5
Fixed Bugs
54262 No timeout message if loading modules fails
This has been fixed by adding further check for correct require error.
Patch Release 5231 (2019-05-13)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev46
- Open-Xchange Driverestricted 7.6.3-rev4
Fixed Vulnerabilities
62465 CVE-2019-11806
CVSS: 3.3
Patch Release 5165 (2019-03-13)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev45
Fixed Vulnerabilities
63411 CVE-2019-9739
Patch Release 5104 (2019-02-11)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev44
- Open-Xchange AppSuite frontend 7.6.3-rev42
Fixed Vulnerabilities
61771 CVE-2019-7159
CVSS: 4.1
Patch Release 4895 (2018-11-19)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev43
- Open-Xchange AppSuite frontend 7.6.3-rev35
Fixed Vulnerabilities
60089 CVE-2018-18462
CVSS: 5.4
60088 CVE-2018-18462
CVSS: 5.3<
Fixed Bugs
56912 Added \n after logout to signature
New/Missing line breaks after sanitizing.This has been solved by do not pretty print signatures for OX6.
56001 Mail folder not loading: String index out of range
Possible ‘java.lang.StringIndexOutOfBoundsException’ while parsing an address list.This has been solved by orderly reseting cached string length after string was modified.
53456 Mail content not displayed with broken content type
Corrupt/broken Content-Type header in a MIME part breaks parsing of a mail message.This has been fixed by dealing with corrupt/broken Content-Type header when parsing a MIME part.
Patch Release 4860 (2018-08-20)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev41
- Open-Xchange AppSuite frontend 7.6.3-rev34
Fixed Vulnerabilities
59507 CVE-2018-13105
CVSS: 3.5
58742 CVE-2018-13104
CVSS: 5.4
56558 CVE-2018-13103
CVSS: 4.3
56457 CVE-2018-13103
CVSS: 4.3
Fixed Bugs
59293 Mail not displayed because of invalid content type
Corrupt/broken Content-Type header in a MIME part breaks parsing of a mail message.This has been solved by dealing with corrupt/broken Content-Type header when parsing a MIME part.
Patch Release 4839 (2018-07-16)
Shipped Components and Versions
- Open-Xchange Documentconverter 7.6.3-rev5
Fixed Bugs
59388 Internal version string check broken in documentconverter
Used deprecated title string.This has been solved by updating title string and Documentconverter server check on client side.
Patch Release 4789 (2018-06-25)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev39
- Open-Xchange AppSuite frontend 7.6.3-rev33
- Open-Xchange Documentconverter 7.6.3-rev4
- Open-Xchange Readerengine 7.6.3-rev4
Fixed Vulnerabilities
58874 CVE-2018-12609
CVSS: 6.5
58282 CVE-2018-12611
CVSS: 4.3
58256 CVE-2018-12611
CVSS: 5.4
58226 CVE-2018-12611
CVSS: 4.3
58096 CVE-2018-9997
CVSS: 4.3
Patch Release 4750 (2018-05-14)
Shipped Components and Versions
- Open-Xchange AppSuite frontend 7.6.3-rev32
Fixed Bugs
58333 Incorrect hyper-link encoding for certain links
In case hyper-links in mail contain percentage signs for URI parameters, those could lead to a incorrect locations since we were encoding them twice. This has been solved to just encode quotes in links.
Patch Release 4750 (2018-05-09)
Shipped Components and Versions
- Open-Xchange AppSuite frontend 7.6.3-rev32
Fixed Bugs
58333 Incorrect hyper-link encoding for certain links
In case hyper-links in mail contain percentage signs for URI parameters, those could lead to a incorrect locations since we were encoding them twice. This has been solved to just encode quotes in links.
Patch Release 4667 (2018-04-23)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev37
- Open-Xchange AppSuite frontend 7.6.3-rev31
Fixed Vulnerabilities
58023 CVE-2018-9998
CVSSv3: 3.6
57956 CVE-2018-9997
CVSSv3: 4.3
57692 CVE-2018-9997
CVSSv3: 5.4
57095 CVE-2018-9997
CVSSv3: 5.4
57016 CVE-2018-9997
CVSSv3: 5.4
56740 CVE-2018-5754
CVSSv3: 5.4
56407 CVE-2018-5753
CVSSv3: 4.3
Patch Release 4552 (2018-02-07)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev36
- Open-Xchange AppSuite frontend 7.6.3-rev30
- Open-Xchange AppSuite readerengine 7.6.3-rev3
Fixed Vulnerabilities
56740 CVE-2018-5754
CVSS: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
56718 CVE-2018-5755
CVSS: 7.7 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
56706 CVE-2018-5752
CVSS: 6.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)
56619 CVE-2018-5752
CVSS: 6.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)
56582 CVE-2018-5754
CVSS: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
56359 CVE-2018-5756
CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
56334 CVE-2018-5752
CVSS: 6.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)
56333 CVE-2018-5756
CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Fixed Bugs
56537 Saving drafts creates multiple copies
In some cases saving drafts would not correctly recognize a existing draft of the same mail as the internal reference was lost. Therefor multiple drafts would be created during the save process. This has been solved.
56109 Editing draft mails shows HTML code
A bugfix has been backported that avoids a race-condition where mail content would be displayed as raw HTML tags in case a draft gets edited.
55872 Removed “Open in browser” for IE
Microsoft Office attempts to render documents within the browser instead of downloading them, however not considering cookies required to fetch the requested information. As a result user experience suffers when trying to view or edit MS Office documents stored within OX App Suite. For this and other reasons we decided to remove the “Open in browser” option when using IE-based browsers. We suggest to use OX Documents for in-browser editing work-flows.
48520 Printing with edge not working
Print preview was empty and printing does not print the email content. Now the preview is displayed and it is possible to print with edge.
Patch Release 4470 (2017-12-12)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev35
- Open-Xchange AppSuite frontend 7.6.3-rev29
Fixed Vulnerabilities
56157 CVE-2017-17060
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
56091 CVE-2017-17060
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
56063 CVE-2017-17061
3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
56056 CVE-2017-17062
3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
56055 CVE-2017-17060
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
55830 CVE-2017-17060
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
54915 CVE-2017-17060
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
51464 CVE-2017-17060
5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Patch Release 4423 (2017-10-24)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev33
Fixed Bugs
55881 Inbox not loading
The yielded ‘javax.mail.internet.AddressException’ in case of a parsing error may return ‘null’ when invoking its ‘getRef()’ method.This has been fixed by orderly passing parsed address string to fall-back address instance in case of parsing error.
Patch Release 4133 (2017-05-15)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev28
Fixed Vulnerabilities
53077 CVE-2017-8340
CVSS: 3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
53073 CVE-2017-8340
CVSS: 3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
52040 CVE-2017-6913
CVSS: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Patch Release 4047 (2017-04-03)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev26
Fixed Vulnerabilities
52255 CVE-2017-6912
CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
51863 CVE-2017-6913
CVSS: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
51667 CVE-2016-10078
CVSS: 3.6 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/CR:L)
51622 CVE-2017-6912
CVSS: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Fixed Bugs
51839 Certain serious (non UCE/UBE) HTML mail is not displayed
Too greedy check for possibly malicious content led to this issue.This has been solved by allowing properly parsed start tag.
Patch Release 3991 (2017-02-28)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev25
Fixed Bugs
51859 Changed API behaviour leads to issues with file uploads
An earlier bugfix introduced a significant change to HTTP API behaviour, any change to the MIME-Type parameter has been rejected as a result. While OX clients were unaffected, this led to an incompatibility with third-party clients when using the “infostore” API for uploading and modifying files. We reduced the scope of the change to block MIME-Types that start with “multipart” instead, this should not affect the vast majority of use-cases for this API.
Patch Release 3949 (2017-02-20)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev24
- Open-Xchange AppSuite frontend 7.6.3-rev23
- Open-Xchange Office 7.6.3-rev5
Fixed Vulnerabilities
51480 CVE-2017-5864
CVSS: 5.4
51474 CVE-2017-5864
CVSS: 4.3
51464 CVE-2017-5864
CVSS: 3.5
51219 CVE-2017-5864
CVSS: 5.4
51202 CVE-2017-5864
CVSS: 5.4
51164 CVE-2017-5210
CVSS: 3.6
51069 CVE-2017-5863
CVSS: 4.3
51058 CVE-2016-10078
CVSSv3: 3.6
51039 CVE-2017-5864
CVSS: 3.3
50849 CVE-2017-5213
CVSS: 3.1
50716 CVE-2016-10077
CVSS: 4.3
50715 CVE-2016-10078
CVSS: 5.3
Patch Release 3922 (2017-01-26)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev23
Fixed Bugs
51263 Missing function returned in case requested files could not be found
A earlier fix changed the response content when requesting a frontend related file. Instead of a function and a error message, just a error message was returned. As a result the web frontend could get stuck in case a file was not found. This has been solved by providing a similar response than earlier, just with obfuscated payload.
Patch Release 3875 (2017-01-23)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev22
- Open-Xchange AppSuite frontend 7.6.3-rev22
Fixed Vulnerabilities
50943 CVE-2016-10077
CVSS: 5.4
50940 CVE-2017-5211
CVSS: 7.1
50893 CVE-2017-5211
CVSS: 4.3
50764 CVE-2017-5210
CVSS: 4.8
50760 CVE-2017-5211
CVSS: 7.1
50748 CVE-2017-5213
CVSS: 4.3
50739 CVE-2017-5212
CVSS: 6.4
50737 CVE-2017-5213
CVSS: 2.2
50734 CVE-2016-10077
CVSS: 5.4
50733 CVE-2016-10078
CVSSv3: 3.6
50723 CVE-2016-10077
CVSS: 4.3
50721 CVE-2017-5211
CVSS: 4.3
50382 CVE-2016-10077
CVSS: 5.4
Patch Release 3728 (2016-11-21)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev20
- Open-Xchange AppSuite frontend 7.6.3-rev20
- Open-Xchange Office 7.6.3-rev4
Fixed Vulnerabilities
49912 CVE-2016-9309
CVSS: 4.3
49848 CVE-2016-9308
CVSS: 5.7
49847 CVE-2016-9309
CVSS: 3.7
49439 CVE-2016-9308
CVSS: 4.1
49014 CVE-2016-9309
CVSS: 5.3
Patch Release 3627 (2016-10-24)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3.-rev18
- Open-Xchange Documentconverter 7.6.3-rev3
Fixed Vulnerabilities
49159 CVE-2016-8857
CVSS: 5.3
49155 CVE-2016-8857
CVSS: 2.0
49015 CVE-2016-8857
CVSS: 3.5
49014 CVE-2016-8857
CVSS: 5.3
49005 CVE-2016-8857
CVSS: 5.3
48843 CVE-2016-7546
CVSS: 3.1
47781 CVE-2016-6845
CVSS: 5.4
Fixed Bugs
47967 High CPU usage by Java process
An infinite loop while trying to determine a folder’s reverse path to root folder caused the excessive creation of folder instances all kept in a wrapping java.util.ArrayList instance. It turned out that while loading the path for a folder from a subscribed external IMAP account, the special INBOX folder references itself as parent, consequently rendering the traversing loop infinite.This has been solved by introducing several safety checks (in case a folder references itself as parent) and guards to prevent from possible such an infinite loop when trying to determine a folder’s path to root folder.
46103 Not possible to send mail with more than one comma in senders name
Empty strings in splitAddrs method cause index out of bound exception.This has been fixed by skipping empty strings.
Patch Release 3569 (2016-09-26)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev17
- Open-Xchange AppSuite frontend 7.6.3-rev18
- Open-Xchange Documents frontend 7.6.3-rev5
Fixed Vulnerabilities
48559 CVE-2016-7546
CVSS: 4.3
48282 CVE-2016-7546
CVSS: 2.2
48231 CVE-2016-7546
CVSS: 4.3
48230 CVE-2016-7546
CVSS: 5.4
Patch Release 3519 (2016-08-29)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev15
- Open-Xchange AppSuite frontend 7.6.3-rev16
- Open-Xchange Office Web 7.6.3-rev4
Fixed Vulnerabilities
48083 CVE-2016-6850
CVSS: 4.3
4.3
47898 CVE-2016-6847
CVSS: 4.3
47891 CVE-2016-6852
CVSS: 5.0
47824 CVE-2016-6850
CVSS: 4.3
47822 CVE-2016-6848
CVSS: 6.4
47790 CVE-2016-6849
CVSS: 7.1
47781 CVE-2016-6845
CVSS: 5.4
47774 CVE-2016-6846
CVSS: 4.3
47770 CVE-2016-6844
CVSS: 4.3
47601 CVE-2016-6842
CVSS: 4.3
Patch Release 3464 (2016-08-01)
Shipped Components and Versions
- Open-Xchange AppSuite backend 7.6.3-rev14
- Open-Xchange AppSuite frontend 7.6.3-rev15
Fixed Vulnerabilities
47062 CVE-2016-5740
CVSS: 4.3
46894 CVE-2016-5740
CVSS: 4.3
46484 CVE-2016-5740
CVSS: 4.3