Advanced search  

News:

CPG Release 1.6.26
Correct PHP8.2 issues with user and language managers.
Additional fixes for PHP 8.2
Correct PHP8 error with SMF 2.0 bridge.
Correct IPTC supplimental category parsing.
Download and info HERE

Pages: [1]   Go Down

Author Topic: cpg1.4.20 Security release - upgrade mandatory!  (Read 55176 times)

0 Members and 1 Guest are viewing this topic.

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
cpg1.4.20 Security release - upgrade mandatory!
« on: February 04, 2009, 09:18:19 am »

The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.4.19 or older update to this latest version as soon as possible.

How to update:
Users running versions prior to 1.4.20 should update immediately by downloading the latest version from the download page page and follow the upgrade steps in the documentation.

Support:
If you have problems with this update, please use the Update support board. Do not post your issues to this announcement thread - they will be deleted without notice.

Why was cpg1.4.20 released?
The release covers a recently discovered vulnerability that allows (if unpatched) the uploading and execution of remote code (milw0rm exploit 7909). Additionally, these non-security related issues have been fixed:
  • Updated XMB bridge file to work with recent versions of that application (user contribution, thread ID 57550)
  • Update names associated with pictures and comments when user name is changed
  • Fixed issue involving display of name field in the report to admin form
  • Added missing translation to German language files (thread ID 56204)
  • Re-did the credits section of the language files for easier future integration into cpg1.5.x
  • Removed double ; at line ends (thread ID 51899)
  • Fixed validation issue with registration screen (thread ID 51310)
  • Added error message if pic editor is being run with missing parameters or without authorization (thread ID 54414)
  • Fixed error message in ecard.php that complained about wrong recipient email although sender email is wrong (thread ID 50844)
  • Fixed minor smilies issue (thread ID 52804)
  • Fixed upload permission issue for bridged galleries (thread ID 50798)
  • Improved improper translation (thread ID 50460)
  • Corrected SMF2 anonymous user fix
  • Reduced memory usage of keyword manager
  • Added Croation language file (user contribution)
  • Fixing thumbnail dimension calculation rounding error

Big thanks go to Michael Brooks and str0ke at milw0rm who discovered the vulnerability and Aditya for coming up with the fix.

Thanks,
The Coppermine Team
« Last Edit: February 04, 2009, 11:16:30 am by Joachim Müller »
Logged

Pascal YAP

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: fr
  • Offline Offline
  • Gender: Male
  • Posts: 13833
  • Hello World :-)
    • CPG 1.5.x ExperiMental website
Logged
Pages: [1]   Go Up
 

Page created in 0.021 seconds with 19 queries.