2

Just upgraded a site to 4.6.11 (long story as to why).

CiviCRM is showing the "Security update required", which links to https://civicrm.org/advisory

As I click on advisory after advisory, in reverse chronological order starting from "CIVI-SA-2015-011: REFLECTED XSS IN ERROR MESSAGE", all have been fixed prior to 4.6.11.

So ... what is the vulnerability then, if I don't upgrade to 4.7.1?

Improve this question

1 Answer 1

Reset to default
3

I'm guessing the advisory will be posted any moment, but you should be able to go to 4.6.12 instead of jumping to 4.7. I believe the 4.6.x branch is now a LTS branch so you don't need to go to 4.7 immediately.

Update: The advisories have been updated (shortly after I posted) and also an email has been sent to the security list (subscribe here):

This is a notification of a security release for CiviCRM. We recommend you immediately upgrade to a secure version of CiviCRM.

The most recent releases are CiviCRM 4.7.1 or CiviCRM 4.6.12. 4.4.21 LTS has been released also.

Some fixes affecting security were included in CiviCRM 4.6.10 and 4.6.11, but the email announcements which should accompany such releases was omitted. So, we're releasing 4.6.12 to time with a security release window and ensure subscribers get notified.

Read the security advisories for details of the various fixes included in the latest CiviCRM builds:

A number of other non-security issues have also been fixed in the latest releases. Upgrade now for the most stable CiviCRM experience.

CiviCRM security announcements are available from https://civicrm.org/advisory and via the CiviCRM Security Notifications email list.

CiviCRM.org, San Francisco, CA 94117 United States

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.