Axigen 10.6.39

SECURITY

• Fix stored XSS through HTML in message header display names rendered by the conversation view (AXI-7604 • CVE-Pending • LEARN MORE)
• Fix HTTP header injection via the recover password proxy endpoint (AXI-7393)
• Update dependencies to fix multiple vulnerabilities (AXI-7489)
• Update nanoid to fix the loop vulnerability (AXI-7505)
• Update dependencies to fix multiple vulnerabilities (AXI-7598)
• Update dependencies to fix multiple vulnerabilities (AXI-7607)

SERVER

• Fix scenario that allows a reported mailbox size to exceed the maximum mailbox quota (AXI-7378)
• Fix scenario resulting in slow account deletions (AXI-7407)
• Avoid temporary denied responses when detecting high rate of abnormal storage operations (AXI-7442)
• Add CLI command to show recent password change timestamps (AXI-7482)
• Kill the whole bdamserver process group before spawning a replacement master (AXI-7483)
• Add exception handling for quota, throttling, and permissions checks during UNDO BATCH operations (AXI-7521)
• Fix my_timegm deadlock on TSAN test builds (AXI-7602)

WEBMAIL

• Fix raw HTML tags appearing in the event description created from a mail (AXI-7395)
• Resolve the correct message when a draft is opened for editing from a temporary search folder (AXI-7450)
• Fix Calendar current-time indicator swallowing clicks on the grid cell it crosses (AXI-7603)

OTHER

• Derive the DEB shared-library dependencies from the binaries instead of hardcoding them (AXI-7485)