The following bug has been fixed:
[-] PCI compliance scanners are failing because Courier IMAP is not PCI compliant
Comment
Archive for October 10th, 2012
9 results.
(Oct 7) Several vulnerabilities were discovered in Icedove, Debian’s version of the Mozilla Thunderbird mail and news client. This includes several instances of use-after-free and buffer overflow [More…]
(Oct 9) Several security issues were fixed in the kernel.
(Oct 9) The system could be made to run actions or potentially programs as anadministrator.
(Oct 9) An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical [More…]
(Oct 9) Updated kernel packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 5.6 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More…]
- Project: Joomla!
- SubProject: All
- Severity: Low
- Versions: 3.0.0
- Exploit type: XSS Vulnerability
- Reported Date: 2012-October-01
- Fixed Date: 2012-October-09
Description
Typographical error leads to XSS vulnerability in language search component.
Affected Installs
Joomla! version 3.0.0.
Solution
Upgrade to version 3.0.1
Reported by Jeff Channell
Contact
The JSST at the Joomla! Security Center.
The following bug has been fixed:
[-] PCI compliance scanners are failing because Courier IMAP is not PCI compliant
Joomla 3.0.1 Released
Oct10
The Joomla Project is pleased to announce the immediate availability of Joomla 3.0.1. This is a security release. This release also fixes several high-priority problems with version 3.0.0.
IMPORTANT NOTE FOR 3.0.0 SITES: If you plan to update a site from 3.0.0 to 3.0.1, you need to install the Joomla 3.0.0 Hot Patch before doing the update to Joomla 3.0.1. See the Hot Patch Instructions for more information. This is NOT required for updating from version 2.5.x. If you require the FTP layer you will need to manually FTP the update. Also, please note that version 3.0 users need to make sure the Update server is set to “Short Term Support” in the Joomla! Update component. Otherwise, no 3.0.x updates will show.
The Production Leadership Team’s goal is to continue to provide regular, frequent updates to the Joomla community. Learn more about Joomla! development at the Developer Site.
Download
New Installations: Click here to download Joomla 3.0.1 (Full package) »
Hot Patch (required for update from 3.0.0): Click here to download Joomla 3.0.0 Hot Patch »
Update Package: Click here to download Joomla 3.0.0 to 3.0.1 (Update package) »
Update Package: Click here to download Joomla 3.0.1 (for updates from Joomla 2.5) (Update package) »
Note: Please read the special update instructions before updating. Updating from 3.0.0 requires that you apply the hot patch first.
Instructions
Want to test drive Joomla? Try the online demo or the Joomla JumpBox. Documentation is available for beginners.
Please note that you should always backup your site before upgrading.
Release Notes
Check the Joomla 3.0.1 Post-Release FAQs to see if there are important items and helpful hints discovered after the release.
Statistics for the 3.0.1 release period
- Joomla 3.0.1 contains:
- 1 security issue fixed
- 1 new feature
- 47 tracker issues fixed
Security Issues Fixed
- Low Priority – Core – XSS Vulnerability. More information »
New Feature
- 29445 Allow different update packages for different version dev levels
Until now, for both core auto updates and extension updates, update packages have been controlled by the 2-digit version number (e.g., 2.5, 3.0). It is not possible,for example, to have users of version 3.0.0 install a different update package than users of 3.0.1. This means the update packages are larger than they need to be. This feature allows for checking all three elements of a version number.
Tracker Issues Fixed
Joomla! Bug Squad
Thanks to the Joomla Bug Squad for their dedicated efforts investigating reports, fixing problems, and applying patches to Joomla. If you find a bug in Joomla, please report it on the Joomla! CMS Issue Tracker.
Active members of the Joomla Bug Squad during the past three months include: Aaron Wood, Andrea Tarr, Bill Richardson, Brian Teeman, Christophe Demko, Dean Clarke, Dennis Hermacki, Elin Waring, Emerson Rocha Luiz, Harald Leithner, Itamar Elharar, Jacob Waisner, James Brice, Janich Rasmussen, Jean-Marie Simonet, Kevin Griffiths, Loyd Headrick, Marijke Stuivenberg, Marius van Rijnsoever, Mark Dexter, Matt Thomas, Michael Babker, Neil McNulty, Nicholas Dionysopoulos, Nick Savov, Nikolai Plath, Ofer Cohen, Peter Wiseman, rachmat wakjaer, Radek Suski, rob clayburn, Roland Dalmulder, Rouven Weßling, Rune Sjøen, Samuel Moffatt, Shaun Maunder, Soheil Novinfard, Troy Hall, Viet Vu.
Bug Squad Leadership: Mark Dexter, Coordinator.
Joomla! Security Strike Team
A big thanks to the Joomla! Security Strike Team for their ongoing work to keep Joomla secure. Members include: Airton Torres, Alan Langford, Bill Richardson, Elin Waring, Gary Brooks, Jason Kendall, Jean-Marie Simonet, Jeremy Wilken, Marijke Stuivenberg, Mark Dexter, Michael Babker, Rouven Weßling, Samuel Moffatt.
How can you help Joomla development?
The great news is you don’t have to be a developer to help build Joomla. The Joomla Bug Squad is one of the most active teams in the Joomla development process and is always looking for people (not just developers) that can help with sorting bug reports, coding patches and testing solutions. It’s a great way for increasing your working knowledge of Joomla, and also a great way to meet new people from all around the world.
If you are interested, please read about us on the Joomla Wiki and, if you wish to join, email the Bug Squad coordinator.
You can also help Joomla development by thanking those involved in the many areas of the process.