Aggregated bug-fixes for 7.6.3

Last Update: 2026-08-25

Patch Release 6293 (2024-07-04)

Shipped Components and Versions

Fixed Bugs

MWB-2639 Mail body partially displayed in webmail

Don’t filter “w:sdt” elements during sanitizing.

Patch Release 6288 (2024-06-14)

Shipped Components and Versions

Fixed Vulnerabilities

INU-4481

Patch Release 5910 (2020-11-24)

Shipped Components and Versions

Fixed Bugs

ONM-2 increase of threads since update to 7.6.3-52_53

Response may not be closed/consumed.Always close the response. This closes the low level apache connection, too.

ONM-1 Optimize contact fetching

No connection pool and possible too many results in the response.Reduce resultset by adding a filter (not in trash) and use a global connection pool.

Patch Release 5637 (2020-03-09)

Shipped Components and Versions

Fixed Vulnerabilities

MWB-34 CVE-2020-8543

CVSS: 3.1

68441 CVE-2019-18846

CVSS: 5.0

Fixed Bugs

MWB-116 OOM, backend/hazelcast crashes frequently

Many unnecessary cache invalidation events related to “User” cache region due to recording the time stamp of last login.This has been solved by only updating user attribute if it actually was changed, skip cluster-wide invalidation.

Patch Release 5537 (2020-01-14)

Shipped Components and Versions

Fixed Vulnerabilities

68258 CVE-2019-18846

CVSS: 5.0

67980 CVE-2019-18846

CVSS: 5.0

67874 CVE-2019-18846

CVSS: 5.0

67871 CVE-2019-18846

CVSS: 6.5

Fixed Bugs

54262 No timeout message if loading modules fails

This has been fixed by adding further check for correct require error.

Patch Release 5537 (2020-01-14)

Shipped Components and Versions

Fixed Vulnerabilities

68258 CVE-2019-18846

CVSS: 5.0

67980 CVE-2019-18846

CVSS: 5.0

67874 CVE-2019-18846

CVSS: 5.0

67871 CVE-2019-18846

CVSS: 6.5

Fixed Bugs

54262 No timeout message if loading modules fails

This has been fixed by adding further check for correct require error.

Patch Release 5231 (2019-05-13)

Shipped Components and Versions

Fixed Vulnerabilities

62465 CVE-2019-11806

CVSS: 3.3

Patch Release 5165 (2019-03-13)

Shipped Components and Versions

Fixed Vulnerabilities

63411 CVE-2019-9739

Patch Release 5104 (2019-02-11)

Shipped Components and Versions

Fixed Vulnerabilities

61771 CVE-2019-7159

CVSS: 4.1

Patch Release 4895 (2018-11-19)

Shipped Components and Versions

Fixed Vulnerabilities

60089 CVE-2018-18462

CVSS: 5.4

60088 CVE-2018-18462

CVSS: 5.3<

Fixed Bugs

56912 Added \n after logout to signature

New/Missing line breaks after sanitizing.This has been solved by do not pretty print signatures for OX6.

56001 Mail folder not loading: String index out of range

Possible ‘java.lang.StringIndexOutOfBoundsException’ while parsing an address list.This has been solved by orderly reseting cached string length after string was modified.

53456 Mail content not displayed with broken content type

Corrupt/broken Content-Type header in a MIME part breaks parsing of a mail message.This has been fixed by dealing with corrupt/broken Content-Type header when parsing a MIME part.

Patch Release 4860 (2018-08-20)

Shipped Components and Versions

Fixed Vulnerabilities

59507 CVE-2018-13105

CVSS: 3.5

58742 CVE-2018-13104

CVSS: 5.4

56558 CVE-2018-13103

CVSS: 4.3

56457 CVE-2018-13103

CVSS: 4.3

Fixed Bugs

59293 Mail not displayed because of invalid content type

Corrupt/broken Content-Type header in a MIME part breaks parsing of a mail message.This has been solved by dealing with corrupt/broken Content-Type header when parsing a MIME part.

Patch Release 4839 (2018-07-16)

Shipped Components and Versions

Fixed Bugs

59388 Internal version string check broken in documentconverter

Used deprecated title string.This has been solved by updating title string and Documentconverter server check on client side.

Patch Release 4789 (2018-06-25)

Shipped Components and Versions

Fixed Vulnerabilities

58874 CVE-2018-12609

CVSS: 6.5

58282 CVE-2018-12611

CVSS: 4.3

58256 CVE-2018-12611

CVSS: 5.4

58226 CVE-2018-12611

CVSS: 4.3

58096 CVE-2018-9997

CVSS: 4.3

Patch Release 4750 (2018-05-14)

Shipped Components and Versions

Fixed Bugs

58333 Incorrect hyper-link encoding for certain links

In case hyper-links in mail contain percentage signs for URI parameters, those could lead to a incorrect locations since we were encoding them twice. This has been solved to just encode quotes in links.

Patch Release 4750 (2018-05-09)

Shipped Components and Versions

Fixed Bugs

58333 Incorrect hyper-link encoding for certain links

In case hyper-links in mail contain percentage signs for URI parameters, those could lead to a incorrect locations since we were encoding them twice. This has been solved to just encode quotes in links.

Patch Release 4667 (2018-04-23)

Shipped Components and Versions

Fixed Vulnerabilities

58023 CVE-2018-9998

CVSSv3: 3.6

57956 CVE-2018-9997

CVSSv3: 4.3

57692 CVE-2018-9997

CVSSv3: 5.4

57095 CVE-2018-9997

CVSSv3: 5.4

57016 CVE-2018-9997

CVSSv3: 5.4

56740 CVE-2018-5754

CVSSv3: 5.4

56407 CVE-2018-5753

CVSSv3: 4.3

Patch Release 4552 (2018-02-07)

Shipped Components and Versions

Fixed Vulnerabilities

56740 CVE-2018-5754

CVSS: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

56718 CVE-2018-5755

CVSS: 7.7 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

56706 CVE-2018-5752

CVSS: 6.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)

56619 CVE-2018-5752

CVSS: 6.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)

56582 CVE-2018-5754

CVSS: 5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

56359 CVE-2018-5756

CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

56334 CVE-2018-5752

CVSS: 6.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L)

56333 CVE-2018-5756

CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Fixed Bugs

56537 Saving drafts creates multiple copies

In some cases saving drafts would not correctly recognize a existing draft of the same mail as the internal reference was lost. Therefor multiple drafts would be created during the save process. This has been solved.

56109 Editing draft mails shows HTML code

A bugfix has been backported that avoids a race-condition where mail content would be displayed as raw HTML tags in case a draft gets edited.

55872 Removed “Open in browser” for IE

Microsoft Office attempts to render documents within the browser instead of downloading them, however not considering cookies required to fetch the requested information. As a result user experience suffers when trying to view or edit MS Office documents stored within OX App Suite. For this and other reasons we decided to remove the “Open in browser” option when using IE-based browsers. We suggest to use OX Documents for in-browser editing work-flows.

48520 Printing with edge not working

Print preview was empty and printing does not print the email content. Now the preview is displayed and it is possible to print with edge.

Patch Release 4470 (2017-12-12)

Shipped Components and Versions

Fixed Vulnerabilities

56157 CVE-2017-17060

5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

56091 CVE-2017-17060

5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

56063 CVE-2017-17061

3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

56056 CVE-2017-17062

3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

56055 CVE-2017-17060

5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

55830 CVE-2017-17060

5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

54915 CVE-2017-17060

5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

51464 CVE-2017-17060

5.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

Patch Release 4423 (2017-10-24)

Shipped Components and Versions

Fixed Bugs

55881 Inbox not loading

The yielded ‘javax.mail.internet.AddressException’ in case of a parsing error may return ‘null’ when invoking its ‘getRef()’ method.This has been fixed by orderly passing parsed address string to fall-back address instance in case of parsing error.

Patch Release 4133 (2017-05-15)

Shipped Components and Versions

Fixed Vulnerabilities

53077 CVE-2017-8340

CVSS: 3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

53073 CVE-2017-8340

CVSS: 3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

52040 CVE-2017-6913

CVSS: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Patch Release 4047 (2017-04-03)

Shipped Components and Versions

Fixed Vulnerabilities

52255 CVE-2017-6912

CVSS: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

51863 CVE-2017-6913

CVSS: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

51667 CVE-2016-10078

CVSS: 3.6 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/CR:L)

51622 CVE-2017-6912

CVSS: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Fixed Bugs

51839 Certain serious (non UCE/UBE) HTML mail is not displayed

Too greedy check for possibly malicious content led to this issue.This has been solved by allowing properly parsed start tag.

Patch Release 3991 (2017-02-28)

Shipped Components and Versions

Fixed Bugs

51859 Changed API behaviour leads to issues with file uploads

An earlier bugfix introduced a significant change to HTTP API behaviour, any change to the MIME-Type parameter has been rejected as a result. While OX clients were unaffected, this led to an incompatibility with third-party clients when using the “infostore” API for uploading and modifying files. We reduced the scope of the change to block MIME-Types that start with “multipart” instead, this should not affect the vast majority of use-cases for this API.

Patch Release 3949 (2017-02-20)

Shipped Components and Versions

Fixed Vulnerabilities

51480 CVE-2017-5864

CVSS: 5.4

51474 CVE-2017-5864

CVSS: 4.3

51464 CVE-2017-5864

CVSS: 3.5

51219 CVE-2017-5864

CVSS: 5.4

51202 CVE-2017-5864

CVSS: 5.4

51164 CVE-2017-5210

CVSS: 3.6

51069 CVE-2017-5863

CVSS: 4.3

51058 CVE-2016-10078

CVSSv3: 3.6

51039 CVE-2017-5864

CVSS: 3.3

50849 CVE-2017-5213

CVSS: 3.1

50716 CVE-2016-10077

CVSS: 4.3

50715 CVE-2016-10078

CVSS: 5.3

Patch Release 3922 (2017-01-26)

Shipped Components and Versions

Fixed Bugs

51263 Missing function returned in case requested files could not be found

A earlier fix changed the response content when requesting a frontend related file. Instead of a function and a error message, just a error message was returned. As a result the web frontend could get stuck in case a file was not found. This has been solved by providing a similar response than earlier, just with obfuscated payload.

Patch Release 3875 (2017-01-23)

Shipped Components and Versions

Fixed Vulnerabilities

50943 CVE-2016-10077

CVSS: 5.4

50940 CVE-2017-5211

CVSS: 7.1

50893 CVE-2017-5211

CVSS: 4.3

50764 CVE-2017-5210

CVSS: 4.8

50760 CVE-2017-5211

CVSS: 7.1

50748 CVE-2017-5213

CVSS: 4.3

50739 CVE-2017-5212

CVSS: 6.4

50737 CVE-2017-5213

CVSS: 2.2

50734 CVE-2016-10077

CVSS: 5.4

50733 CVE-2016-10078

CVSSv3: 3.6

50723 CVE-2016-10077

CVSS: 4.3

50721 CVE-2017-5211

CVSS: 4.3

50382 CVE-2016-10077

CVSS: 5.4

Patch Release 3728 (2016-11-21)

Shipped Components and Versions

Fixed Vulnerabilities

49912 CVE-2016-9309

CVSS: 4.3

49848 CVE-2016-9308

CVSS: 5.7

49847 CVE-2016-9309

CVSS: 3.7

49439 CVE-2016-9308

CVSS: 4.1

49014 CVE-2016-9309

CVSS: 5.3

Patch Release 3627 (2016-10-24)

Shipped Components and Versions

Fixed Vulnerabilities

49159 CVE-2016-8857

CVSS: 5.3

49155 CVE-2016-8857

CVSS: 2.0

49015 CVE-2016-8857

CVSS: 3.5

49014 CVE-2016-8857

CVSS: 5.3

49005 CVE-2016-8857

CVSS: 5.3

48843 CVE-2016-7546

CVSS: 3.1

47781 CVE-2016-6845

CVSS: 5.4

Fixed Bugs

47967 High CPU usage by Java process

An infinite loop while trying to determine a folder’s reverse path to root folder caused the excessive creation of folder instances all kept in a wrapping java.util.ArrayList instance. It turned out that while loading the path for a folder from a subscribed external IMAP account, the special INBOX folder references itself as parent, consequently rendering the traversing loop infinite.This has been solved by introducing several safety checks (in case a folder references itself as parent) and guards to prevent from possible such an infinite loop when trying to determine a folder’s path to root folder.

46103 Not possible to send mail with more than one comma in senders name

Empty strings in splitAddrs method cause index out of bound exception.This has been fixed by skipping empty strings.

Patch Release 3569 (2016-09-26)

Shipped Components and Versions

Fixed Vulnerabilities

48559 CVE-2016-7546

CVSS: 4.3

48282 CVE-2016-7546

CVSS: 2.2

48231 CVE-2016-7546

CVSS: 4.3

48230 CVE-2016-7546

CVSS: 5.4

Patch Release 3519 (2016-08-29)

Shipped Components and Versions

Fixed Vulnerabilities

48083 CVE-2016-6850

CVSS: 4.3

48061

4.3

47898 CVE-2016-6847

CVSS: 4.3

47891 CVE-2016-6852

CVSS: 5.0

47824 CVE-2016-6850

CVSS: 4.3

47822 CVE-2016-6848

CVSS: 6.4

47790 CVE-2016-6849

CVSS: 7.1

47781 CVE-2016-6845

CVSS: 5.4

47774 CVE-2016-6846

CVSS: 4.3

47770 CVE-2016-6844

CVSS: 4.3

47601 CVE-2016-6842

CVSS: 4.3

Patch Release 3464 (2016-08-01)

Shipped Components and Versions

Fixed Vulnerabilities

47062 CVE-2016-5740

CVSS: 4.3

46894 CVE-2016-5740

CVSS: 4.3

46484 CVE-2016-5740

CVSS: 4.3