HowTo-Outlook

A Security Update has been released for Outlook 2013. It resolves the following vulnerability;

• CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
  • This vulnerability is currently not publicly disclosed but it is exploited.
  • The exploit for this vulnerability can be triggered automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation BEFORE the email is viewed in the Preview Pane.
  • The Exploitability Assessment is rated: Exploitation Detected.

Exchange administrators can use this script to analyze whether mailboxes have been targeted by potentially malicious messages.

View: Download information for KB5002265

Note: This update can be installed via Microsoft Update or the Update Now button when you are using Office 2013 Click-To-Run and updates Outlook to version 15.0.5537.1000.

Microsoft released the February 2023 feature update of Outlook for Microsoft 365 Apps in the Current Channel.

Unfortunately, it is yet a very uneventful release when it comes to Outlook.

Although there is nothing specified for Outlook, there are 1 feature and 1 fix mentioned for other Office apps which are Outlook/email related;

• User-defined permissions now support domain name restrictions
  When you choose a sensitivity label configured for user-defined permissions, domain names can now be used to restrict file access to all individuals from that domain.
  For example, you can specify “someone@example.com” or “@example.com,” and permissions will be restricted based on either the individual or all individuals within the example domain. (Word, Excel, and PowerPoint)

• We fixed an issue that when clicking on an email notification with @mention in a comment, caused Excel to close unexpectedly if the workbook was already open and was in a hidden window.

Note: Depending on your installation type, this update can be installed via the Update Now button in Outlook or the Microsoft Store and updates Outlook to: Version 2302 (Build 16130.20218).

The February security and rollup update has been made available for all Click-to-Run installations of Outlook 2016, Outlook 2019, Outlook 2021 and Outlook as part of a Microsoft 365 subscription.

It contains 3 security updates for Word (1), Publisher (1), and Office (1).

In addition, it contains 1 documented non-security fix related to Outlook Current Version 2301, 5 fixes for Semi-Annual Version 2208, 1 fix for Semi-Annual Version 2202, and 1 fix for Semi-Annual Version 2108.

• Version 2301
• We fixed an issue that caused users to experience the application to close unexpectedly when clicking on some non-HTTP links.
• Version 2208
• We fixed an issue that caused S/MIME users to receive an NDR when selecting the “Send Unencrypted” option.
• We fixed an issue that caused users to experience crashes at unpredictable intervals when using some add-ins.
• We fixed an issue where the time slots of calendars in side-by-side view do not line up correctly.
• We fixed an issue that caused attachment size limits to not be evaluated when drag/dropping an attachment into a mail message.
• Fixed an issue where a dialog box saying “Trying to connect” would appear for multiple minutes while trying to save email attachments to a network share.
• Version 2202
• We fixed an issue that caused users to experience crashes at unpredictable intervals when using some add-ins.
• Version 2108
• We fixed an issue where references and reply-to headers were removed when replying to an email and the subject was changed.

Based on your release channel, you’ll be updated to the following version;

• Microsoft 365 Apps, Outlook 2016 Retail, Outlook 2019 Retail, Outlook 2021 Retail
  Version 2301 (Build 16026.20200)
• Monthly Enterprise
  Version 2212 (Build 15928.20282)
  Version 2211 (Build 15831.20280)
• Semi-Annual Enterprise (Preview)
  Version 2208 (Build 15601.20538)
• Semi-Annual Enterprise
  Version 2208 (Build 15601.20538)
  Version 2202 (Build 14931.20926)
  Version 2108 (Build 14326.21336) 
• Outlook LTSC 2021
  Version 2108 (Build 14332.20461)
• Outlook 2019 Volume Licensed
  Version 1808 (Build 10395.20020)

Note: Depending on your installation type, this update can be installed via the Update Now button in Outlook itself or the Microsoft Store. This update does not apply to msi-based installations of Office 2016.

Security updates have been released for Exchange 2013, Exchange 2016 and Exchange 2019.

The updates fix the following vulnerabilities;

• CVE-2023-21529: Remote Code Execution Vulnerability
• CVE-2023-21706: Remote Code Execution Vulnerability
• CVE-2023-21707: Remote Code Execution Vulnerability
• CVE-2023-21710: Remote Code Execution Vulnerability

None of the vulnerabilities are currently publicly disclosed or exploited. However, the first 3 vulnerabilities are rated as “Exploitation More Likely” so make sure you update as soon as possible!

The updates also contain the following non-security issues;

• Export-UMPrompt fails with InvalidResponseException
• Edge Transport service returns an “EseNtOutOfSessions” Exception
• Exchange services in automatic startup mode do not start automatically
• Data source returns incorrect checkpoint depth
• Serialization fails while tried accessing Mailbox Searches in ECP
• Transport delivery service mishandles iCAL events

View: Exchange Blog: Released: February 2023 Exchange Server Security Updates
View: Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: February 14, 2023 (KB5023038)

Download: Security Update for Exchange 2019 CU11 and CU12
Download: Security Update for Exchange 2016 CU23
Download: Security Update for Exchange 2013 CU23 (support ends on April 11, 2023)

Microsoft released the January 2023 feature update of Outlook for Microsoft 365 Apps in the Current Channel.

However, it looks like most of the Outlook Team is still on holidays or have been busy working on other things as this release does not contain any new features or published fixes for Outlook.

However, the Excel Team has been quite busy on improving the PivotTable user experience;

• PivotTable overlap improvements
  We have improved the experience when PivotTables overlap other content in your workbook.
• Excel PivotTable version compatibility user messaging
  Excel now gives alerts about PivotTable compatibility issues and provides informative documentation and workarounds.
• Date Support for Pivot Tables Connected to PowerBI
  In PivotTables that are connected to Power BI datasets, dates are now supported for analysis as the data type is no longer a string. For example, filtering data on specific timeframes is now possible.

Note: Depending on your installation type, this update can be installed via the Update Now button in Outlook or the Microsoft Store and updates Outlook to: Version 2301 (Build 16026.20146).

The January security and rollup update has been made available for all Click-to-Run installations of Outlook 2016, Outlook 2019, Outlook 2021 and Outlook as part of a Microsoft 365 subscription.

It contains 6 security updates for Visio (4) and Office (2).

In addition, it contains 1 new feature and 1 documented non-security fix related to Outlook Monthly Enterprise Version 2211, and 2 fixes for Semi-Annual Preview Version 2208.

• Version 2211
  • S/MIME as an Outcome for labelling
    Providing S/MIME encryption and signing functionality as an outcome of labelling.
  • We fixed an issue that caused the focus on the message list to be lost when using CTRL+Tab to navigate from a folder in one mailbox to a folder in another mailbox.
• Version 2208 Preview
  • Previously, when web add-ins registered for an event in an unsupported scenario, we would simply ignore the registration and return a success. We changed that behavior to return a failure, which ended up impacted existing add-ins, so we have reverted to the previous behavior.
  • We fixed an issue that caused Outlook to fail silently when adding a Modern Group as a shared calendar instead of displaying a sensible error message.

Version 2208 has now also been released to the Semi-Annual Enterprise Channel and contains 4 highlighted new features and 45 fixes which have been made available already to the other release channels. The new features are;

• Use suggested replies in Outlook
  When you receive an email message that can be answered by a short response, Outlook can suggest three responses you can use to reply with just a couple of clicks.
  • Suggested Replies can be turned off via; File-> Options-> Mail-> section: Replies and Forwards-> toggle option: Show suggested replies
• One-click writing suggestions
  Apply writing suggestions with a single click. Editor corrects spelling and grammar and gives you ideas for refining your writing.
• Grammar checking’s got your back
  Outlook marks grammar errors as you type, so you can apply suggestions with a single click.
• Show multiple mini-months in Calendar To-Do Bar
  This feature allows you to show multiple mini-months both horizontally and vertically in the Calendar To-Do bar.

Based on your release channel, you’ll be updated to the following version;

• Microsoft 365 Apps, Outlook 2016 Retail, Outlook 2019 Retail, Outlook 2021 Retail
  Version 2212 (Build 15928.20216)
• Monthly Enterprise
  Version 2211 (Build 15831.20252)
  Version 2210 (Build 15726.20292)
• Semi-Annual Enterprise (Preview)
  Version 2208 (Build 15601.20456)
• Semi-Annual Enterprise
  Version 2208 (Build 15601.20456)
  Version 2202 (Build 14931.20888)
  Version 2108 (Build 14326.21286) 
• Outlook LTSC 2021
  Version 2108 (Build 14332.20447)
• Outlook 2019 Volume Licensed
  Version 1808 (Build 10394.20022)

Note: Depending on your installation type, this update can be installed via the Update Now button in Outlook itself or the Microsoft Store. This update does not apply to msi-based installations of Office 2016.

Security updates have been released for Exchange 2013, Exchange 2016 and Exchange 2019.

The updates fix the following vulnerabilities;

• CVE-2023-21745: Spoofing Vulnerability
• CVE-2023-21761: Information Disclosure Vulnerability
• CVE-2023-21762: Spoofing Vulnerability
• CVE-2023-21763: Elevation of Privilege Vulnerability
• CVE-2023-21764: Elevation of Privilege Vulnerability

None of the vulnerabilities are currently publicly disclosed or exploited. However, CVE-2023-21745 is rated as “Exploitation More Likely” so make sure you update as soon as possible!

From the above vulnerabilities, Exchange 2013 is only affected by CVE-2023-21762. Note however that Exchange 2013 will go out of support on April 11, 2023 so make sure you have your migration plan in order to remain supported.

This release introduces a new feature called; Certificate signing of PowerShell serialization payload in Exchange Server. In short, this helps defend Exchange servers against attacks on serialized data. This feature must be enabled manually but there is a script available for it as well.

The updates also contain the following non-security issues;

• Store Worker Process stops and returns “System.NullReferenceExceptions” multiple times per day (Exchange 2019 and Exchange 2016)
• Can’t record or play in Exchange Unified Messaging (Exchange 2016 and Exchange 2013)
• Exchange Application log is flooded with Event ID 6010 (Exchange 2016)

View: Exchange Blog: Released: Released: January 2023 Exchange Server Security Updates
View: Description of the security update for Microsoft Exchange Server 2019: January 10, 2023 (KB5022193)
View: Description of the security update for Microsoft Exchange Server 2016: January 10, 2023 (KB5022143)
View: Description of the security update for Microsoft Exchange Server 2013: January 10, 2023 (KB5022188)

Download: Security Update for Exchange 2019 CU11 and CU12
Download: Security Update for Exchange 2016 CU23
Download: Security Update for Exchange 2013 CU23

We’re already into the New Year, but Microsoft has now released the December 2022 feature update of Outlook for Microsoft 365 Apps in the Current Channel.

Considering the holidays, it is no surprise that this update is quite light on feature updates and fixes.

Nevertheless, Word got a very cool new feature where you can turn your comment into a task for a team member.

• Tag your team members with tasks
  Create and assign tasks without leaving Word. Simply add a comment, @mention your team member, press Ctrl + Enter, and check Assign. Your comment becomes a task, and your work is done!

Note: Depending on your installation type, this update can be installed via the Update Now button in Outlook or the Microsoft Store and updates Outlook to: Version 2212 (Build 15928.20198).

The December security and rollup update has been made available for all Click-to-Run installations of Outlook 2016, Outlook 2019, Outlook 2021 and Outlook as part of a Microsoft 365 subscription.

It contains 11 security updates for OneNote (1), Visio (3) and Office (7).

In addition, it contains 1 documented non-security fix related to Outlook Monthly Enterprise Version 2210, 4 fixes for Semi-Annual Preview Version 2208, and 2 fixes for Semi-Annual Version 2202.

• Version 2210
  • We fixed an issue that caused emails to get stuck in the outbox for some profiles with multiple Exchange accounts configured.
• Version 2208
  • We fixed an issue that was causing users to see multiple copies of a shared calendar rendered in certain circumstances.
  • Resolved an issue where Outlook would close unexpectedly when clicking on certain email messages with Word document attachments and the reading pane is set to “Right”.
• Version 2208 and Version 2202
  • We defined a Registry key that when set fixes an issue that prevented messages from being sent when Outlook is running with multiple Exchange accounts and at least one of them is in Online mode (as opposed to cached mode.)
    • Key: HkCU\Software\Microsoft\Office\16.0\Outlook\RPC
    • Value Name: UseInclusiveGlobalOfflineCapabilities
    • Value type: REG_DWORD
    • Value (Default): 0
    • Value 1 = Adjusts the Global Offline Capabilities for profiles with Exchange accounts, so that they are less restrictively aggregated/computed.
  • We fixed an issue that caused users to see copies of all of their sent items appearing in their Outbox folder.

Based on your release channel, you’ll be updated to the following version;

• Microsoft 365 Apps, Outlook 2016 Retail, Outlook 2019 Retail, Outlook 2021 Retail
  Version 2211 (Build 15831.20208)
• Monthly Enterprise
  Version 2210 (Build 15726.20262)
  Version 2209 (Build 15629.20298)
• Semi-Annual Enterprise (Preview)
  Version 2208 (Build 15601.20378)
• Semi-Annual Enterprise
  Version 2202 (Build 14931.20858)
  Version 2108 (Build 14326.21248) 
• Outlook LTSC 2021
  Version 2108 (Build 14332.20435)
• Outlook 2019 Volume Licensed
  Version 1808 (Build 10393.20026)

Note: Depending on your installation type, this update can be installed via the Update Now button in Outlook itself or the Microsoft Store. This update does not apply to msi-based installations of Office 2016.

A week late, but Microsoft finally released the November feature update of Outlook for Microsoft 365 Apps in the Current Channel.

This month’s update is very minimal when it comes to Outlook as there is only 1 new (enterprise) feature an 1 highlighted bug fix.

• S/MIME as an Outcome for labelling
  Providing S/MIME encryption and signing functionality as an outcome of labelling.
• We fixed an issue that caused the focus on the message list to be lost when using CTRL+Tab to navigate from a folder in one mailbox to a folder in another mailbox.

Excel got another exciting update this month with the following new feature;

• Insert in-cell images with the new IMAGE function
  Your images can now be part of the worksheet, instead of floating on top. You can move and resize cells, sort and filter, and work with images within an Excel table.

Note: Depending on your installation type, this update can be installed via the Update Now button in Outlook or the Microsoft Store and updates Outlook to: Version 2211 (Build 15831.20190).