Advanced search  

News:

cpg1.5.42 maintenance release - upgrade recommended
The Coppermine development team is releasing an update for Coppermine in order to fix several minor issues. All fixes are not security critical, so if your gallery is running fine with cpg1.5.36, cpg1.5.38 or cpg1.5.40 you don't need to upgrade. If you are running an older version than cpg1.5.36, you must update to this latest version as soon as possible because of the security impact!
[more]

Pages: [1]   Go Down

Author Topic: cpg1.5.36 Security release - upgrade mandatory!  (Read 47502 times)

0 Members and 1 Guest are viewing this topic.

Αndré

  • Administrator
  • Coppermine addict
  • *****
  • Country: de
  • Offline Offline
  • Gender: Male
  • Posts: 15086
cpg1.5.36 Security release - upgrade mandatory!
« on: May 07, 2015, 12:12:44 PM »

The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.34 or older update to this latest version as soon as possible.

How to update:
Users running versions prior to 1.5.36 should update immediately by downloading the latest version from the download page and following the upgrade steps in the documentation.

Support:
If you have problems with this update, please use the Update support board. Do not post your issues to this announcement thread - your post will be deleted without notice.

Why was cpg1.5.36 released?
The release covers a recently discovered XSS vulnerability that allows (if unpatched) a malevolent visitor to include own script routines under certain conditions. Furthermore, an open redirect issue and a directory enumeration issue have been fixed.

Additionally, cpg1.5.36 includes fixes for the following non-security related issues:
  • Strip whitespace from imported IPTC title and caption (thread)
  • Fixed icon when deleting picture from an album (thread)
  • Made phpBB 3 bridge compatible with phpBB version 3.1.x (thread)
  • Updated Italian language file (thread)
  • Fixed database error for non-existing files (thread)
  • Fixed typo in French docs (thread)
Thanks to Mahendra for discovering the vulnerability.


The Coppermine Team
« Last Edit: May 07, 2015, 01:45:49 PM by Αndré »
Logged

Αndré

  • Administrator
  • Coppermine addict
  • *****
  • Country: de
  • Offline Offline
  • Gender: Male
  • Posts: 15086
Re: cpg1.5.36 Security release - upgrade mandatory!
« Reply #1 on: May 07, 2015, 01:45:59 PM »

Users running PHP 4, please read this.
Logged

Phill Luckhurst

  • Administrator
  • Coppermine addict
  • *****
  • Country: gb
  • Offline Offline
  • Gender: Male
  • Posts: 4274
    • Windsurf.me
Re: cpg1.5.36 Security release - upgrade mandatory!
« Reply #2 on: May 07, 2015, 01:58:17 PM »

Thank you Andre for all your hard work in fixing this when you are so busy. Also big thanks to gmc for help in testing and code suggestions.
Logged
It is a mistake to think you can solve any major problems just with potatoes.

jflash

  • Coppermine newbie
  • Offline Offline
  • Posts: 8
Re: cpg1.5.36 Security release - upgrade mandatory!
« Reply #3 on: May 07, 2015, 02:31:29 PM »

Good work!
Logged

zeroresearch

  • Coppermine newbie
  • Offline Offline
  • Posts: 3
Re: cpg1.5.36 Security release - upgrade mandatory!
« Reply #4 on: May 08, 2015, 03:50:03 PM »

Great job guys!

Thanks for the quick response from greg too.

cheerrs
Logged
Pages: [1]   Go Up
 

Page created in 0.063 seconds with 20 queries.