Hi,
eben wurden Joomla 3.4.6 veröffentlicht:
https://www.joomla.org/announc…oomla-3-4-6-released.html
Die Downloads gibt es hier:
https://github.com/joomla/joomla-cms/releases/tag/3.4.6
Das Update auf Joomla 3.4.6 enthält 1 kritisches und 3 nicht kritische Sicherheitspatches.
Da Joomla 1.5 & 2.5 auch betroffen sind wird es hier: https://docs.joomla.org/Securi…s_for_Joomla_EOL_versions die Patches für diese Versionen geben.
EDIT (16.12.2016):
- Fehlendes Sicherheitsupdate hinzugefügt.
Sicherheitspatche in 3.4.6
[20151214] - Core - Remote Code Execution Vulnerability
Project: Joomla!
SubProject: CMS
Severity: High
Versions: 1.5.0 through 3.4.5
Exploit type: Remote Code Execution Vulnerability
Reported Date: 2015-December-13
Fixed Date: 2015-December-14
CVE Number: CVE-2015-8562
Description
Browser information are not filtered properly while saving the session values into the database what leads to a Remote Code Execution vulnerability.
Affected Installs
Joomla! CMS versions 1.5.0 through 3.4.5
Solution
Upgrade to version 3.4.6
Unofficial fixes for Joomla! 1.5.x and 2.5.x will be provided: https://docs.joomla.org/Securi…s_for_Joomla_EOL_versions
Reported By: Uwe Flottemensch
https://developer.joomla.org/s…cution-vulnerability.html
[20151214] - Core - CSRF Hardening
Project: Joomla!
SubProject: CMS
Severity: Low
Versions: 3.2.0 through 3.4.5
Exploit type: CSRF
Reported Date: 2015-November-26
Fixed Date: 2015-December-14
CVE Number: CVE-2015-8563
Description
Add additional CSRF hardening in com_templates.
Affected Installs
Joomla! CMS versions 3.2.0 through 3.4.5
Solution
Upgrade to version 3.4.6
https://developer.joomla.org/s…-directory-traversal.html
[20151214] - Core - Directory Traversal
Project: Joomla!
SubProject: CMS
Severity: Low
Versions: 3.4.0 through 3.4.5
Exploit type: XML File Read Issue
Reported Date: 2015-November-26
Fixed Date: 2015-December-14
CVE Number: CVE-2015-8564
Description
Fails to properly sanitise input data from the XML install file located within the package archive.
Affected Installs
Joomla! CMS versions 3.4.0 through 3.4.5
Solution
Upgrade to version 3.4.6
https://developer.joomla.org/s…-core-csrf-hardening.html
Edit(16.12.2016):
- Nun verfügbare CVE Nummern nachgetragen.
Anscheinend hat man noch eine weitere Lücke geschlossen im offiziellen Blog Post sind nun 4 und nicht nur 3 aufgelistet. Hier die fehlenden Infos:
[20151203] - Core - Directory Traversal
Project: Joomla!
SubProject: CMS
Severity: Low
Versions: 3.4.0 through 3.4.5
Exploit type: Directory Traversal
Reported Date: 2015-November-26
Fixed Date: 2015-December-14
CVE Number: CVE-2015-8564
Description
Failure to properly sanitise input data from the XML install file located within an extension's package archive allows for directory traversal.
Affected Installs
Joomla! CMS versions 3.4.0 through 3.4.5
Solution
Upgrade to version 3.4.6
