[German]With the August 2023 security update, Microsoft closed the Outlook spoofing vulnerability CVE 2023 36893. As a result, the desktop application was no longer able to display images in meeting elements. In addition, the meeting text has been read-only since this date if calendar items from other senders are used for Microsoft Outlook. Microsoft already addressed this problem in Outlook at the end of November 2023 and described and rolled out workarounds. In January 2024, the last Outlook 365 channels will receive the fix.
I recently became aware of the issue via a Facebook request because an Outlook user suddenly stopped seeing images.
Security update from August 8, 2023
The problems occur after installing the security update of August 8, 2023, with which Microsoft has closed the Outlook spoofing vulnerability CVE 2023 36893. Two problems then occur during meetings, as Microsoft states in this support article:
- The meeting is now read-only for the recipient. It is no longer possible to make changes to the meeting text or attach files to the meeting.
- Images in the meeting element that are stored on network paths such as UNC shares (\\server), file share paths (File://server) or external URL paths (https://) are blocked.
There was a German comment in my German blog post Outlook: Body zugesagter Termine nicht mehr änderbar; Office August 2023-Update schuld already indicated that Microsoft is preparing a fix.
Workaround for editing meetings
In November, the Outlook team implemented functions for editing received meetings with a new Edit Meeting button. The changes are already available from Current Channel Version 2311 Build 17029.20068. In the support article, Microsoft describes the steps to add the Edit Meeting button to the Quick Access Toolbar.
This change has been available in the Semi-Annual Enterprise Channel (Preview) since December 12, 2023. In the support article, Microsoft states that the Edit Meeting button will be rolled out on January 9, 2023 in the Semi-Annual Enterprise Channel with version 2308.
On January 9, 2024, this button shall also be made available in the monthly Enterprise channel with version 2311. This feature is only available in the Microsoft 365 subscription and will not be ported to Office 2021, Office 2019 or Office 2016.
