This update limits the number of nested MIME parts to 10 (by default), to avoid a possible memory exhaustion issue with lots of tiny MIME parts.
Comment
Archive for June 2nd, 2020
14 results.
Bug fix and security fix for CVE-2020-12693
Joomla 3.9.19 Release
Jun02
Joomla 3.9.19 is now available. This is a security release for the 3.x series of Joomla which addresses 5 security vulnerabilities and contains over 40 bug fixes and improvements.
- Project: Joomla!
- SubProject: CMS
- Impact: Low
- Severity: Low
- Versions: 3.7.0-3.9.18
- Exploit type: XSS
- Reported Date: 2020-May-08
- Fixed Date: 2020-June-02
- CVE Number: CVE-2020-13760
Description
Missing token checks in com_postinstall cause CSRF vulnerabilities.
Affected Installs
Joomla! CMS versions 3.7.0 – 3.9.18
Solution
Upgrade to version 3.9.19
Contact
The JSST at the Joomla! Security Centre.
Reported By: Khoa Bùi Đức Anh
- Project: Joomla!
- SubProject: CMS
- Impact: Low
- Severity: Moderate
- Versions: 3.0.0-3.9.18
- Exploit type: XSS
- Reported Date: 2020-April-10
- Fixed Date: 2020-June-02
- CVE Number: CVE-2020-11022 and CVE-2020-11023
Description
The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are “[…] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others.”
The Drupal project has backported the relevant fixes back to jQuery 1.x and Joomla has adopted that patch.
Affected Installs
Joomla! CMS versions 3.0.0 – 3.9.18
Solution
Upgrade to version 3.9.19
Contact
The JSST at the Joomla! Security Centre.
Reported By: David Jardin, JSST
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Low
- Versions: 3.0.0-3.9.18
- Exploit type: XSS
- Reported Date: 2020-May-06
- Fixed Date: 2020-June-02
- CVE Number: CVE-2020-XXX
Description
Incorrect input validation of the module tag option in com_modules allow XSS attacks.
Affected Installs
Joomla! CMS versions 3.0.0 – 3.9.18
Solution
Upgrade to version 3.9.19
Contact
The JSST at the Joomla! Security Centre.
Reported By: Lee Thao from Viettel Cyber Security
- Project: Joomla!
- SubProject: CMS
- Impact: Low
- Severity: Low
- Versions: 2.5.0-3.9.18
- Exploit type: Insecure Permissions
- Reported Date: 2020-April-23
- Fixed Date: 2020-June-02
- CVE Number: CVE-2020-13763
Description
The default settings of the global “textfilter” configuration doesn’t block HTML inputs for ‘Guest’ users. With 3.9.19, the textfilter for new installations has been set to ‘No HTML’ for the groups ‘Public’, ‘Guest’ and ‘Registered’.
Affected Installs
Joomla! CMS versions 2.5.0 – 3.9.18
Solution
Upgrade to version 3.9.19
Contact
The JSST at the Joomla! Security Centre.
Reported By: Brian Teeman
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Low
- Versions: 3.0.0-3.9.18
- Exploit type: XSS
- Reported Date: 2020-May-06
- Fixed Date: 2020-June-02
- CVE Number: CVE-2020-13761
Description
Lack of input validation in the heading tag option of the “Articles – Newsflash” and “Articles – Categories” modules allow XSS attacks.
Affected Installs
Joomla! CMS versions 3.0.0 – 3.9.18
Solution
Upgrade to version 3.9.19
Contact
The JSST at the Joomla! Security Centre.
Reported By: Khoa Bùi Đức Anh
An update for jaeger, kiali, and servicemesh-grafana is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
An update for freerdp is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
May was an action-packed month for WordPress! WordPress organizers are increasingly moving WordCamps online, and contributors are taking big steps towards Full Site Editing with Gutenberg. To learn more and get all the latest updates, read on. Gutenberg 8.1 and 8.2 Gutenberg 8.1 was released on May 13, followed quickly by Gutenberg 8.2 on May […]
| Rank | Performance Graph | OS | Outage hh:mm:ss |
Failed Req% |
DNS | Connect | First byte |
Total |
|---|---|---|---|---|---|---|---|---|
| 1 | EveryCity | SmartOS | 0:00:00 | 0.000 | 0.208 | 0.083 | 0.165 | 0.165 |
| 2 | www.flexential.com | Linux | 0:00:00 | 0.000 | 0.237 | 0.090 | 0.179 | 0.179 |
| 3 | Webair | Linux | 0:00:00 | 0.005 | 0.281 | 0.073 | 0.147 | 0.147 |
| 4 | ServerStack | Linux | 0:00:00 | 0.005 | 0.201 | 0.086 | 0.171 | 0.171 |
| 5 | www.choopa.com | Linux | 0:00:00 | 0.010 | 0.203 | 0.004 | 0.021 | 0.021 |
| 6 | Hyve Managed Hosting | Linux | 0:00:00 | 0.010 | 0.139 | 0.074 | 0.148 | 0.148 |
| 7 | CWCS Managed Hosting | Linux | 0:00:00 | 0.010 | 0.280 | 0.080 | 0.163 | 0.163 |
| 8 | GoDaddy.com Inc | Linux | 0:00:00 | 0.014 | 0.371 | 0.006 | 0.033 | 0.035 |
| 9 | Rackspace | Linux | 0:00:00 | 0.014 | 0.430 | 0.013 | 0.027 | 0.028 |
| 10 | Pair Networks | Linux | 0:00:00 | 0.014 | 0.320 | 0.101 | 0.201 | 0.201 |
In May 2020 EveryCity had the most reliable hosting company site, responding to all of Netcraft’s requests with an average connection time of 83ms. For the past nine months EveryCity has appeared in the top 10 most reliable hosting company sites. EveryCity offers cloud hosting solutions and managed third-party services, with its primary data centre located in the heart of London.
Rebase to version 3.32.1
Update to version 1.10.8. Resolves: CVE-2020-1945