mybb MyBB 1.6.6 Security Release

[AWS]

MyBB 1.6.6 is now available from the MyBB website and is a security release for the 1.6 series.

[HEADING=3]What’s added/changed in this version?[/HEADING]

 

In 1.6.6, 1 major issue and 14 low risk vulnerabilities have been fixed. Only the issues listed below are fixed; a further maintenance release will be available with general fixes to functionality in the near future.

 

• Vulnerabilities:
  
  
   
  
  • Non Critical: Import a non-CSS stylesheet (Theme)
     
    
  • Low Risk: CSRF vulnerability on Admin CP logout (http://dev.mybb.com/issues/1769" target="_blank">Issue #1769)
     
    
  • Low Risk: CSRF vulnerability when clearing a stored password (http://dev.mybb.com/issues/1824" target="_blank">Issue #1824)
     
    
  • Low Risk: CSRF vulnerability when removing a buddy (http://dev.mybb.com/issues/1825" target="_blank">Issue #1825)
     
    
  • Low Risk: CSRF vulnerability with Admin CP join requests (http://dev.mybb.com/issues/1834" target="_blank">Issue #1834)
     
    
  • Low Risk: CSRF vulnerability in Group Promotions Enable/Disable
     
    
  • Low Risk: CSRF vulnerability in ACP Edit User (Avatar)
     
    
  • Low Risk: CSRF vulnerability with activating a user
     
    
  • Low Risk: XSS vulnerability when moving an event (Calendar)
     
    
  • Low Risk: XSS vulnerabilities in Akismet plugin
     
    
  • Low Risk: XSS vulnerabilities in Forum Subscriptions (User CP)
     
    
  • Low Risk: XSS vulnerability in Moderator Logs
     
    
  • Low Risk: XSS vulnerability in Edit Post
     
    
  • Low Risk: XSS vulnerability when editing Announcements
     
    

   

  Thanks to SQA Team Member Nathan Malcolm for finding all of these!

   

  [*]Vanishing Announcements in 1.6.5 (http://dev.mybb.com/issues/1781" target="_blank">Issue #1781, http://dev.mybb.com/issues/1785" target="_blank">#1785) – with thanks to Paul H and Vini Holden.

   

 

For more information on these vulnerabilities, please http://wiki.mybb.com/index.php/1.6.6" target="_blank">view the 1.6.6 Changes in the Wiki.

[HEADING=3]Upgrading from 1.6.5 and Other Versions[/HEADING]

 

Before performing any upgrade, please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is required. There are changes to 1 language file. There is 1 change to themes. Please http://wiki.mybb.com/index.php/1.6.6" target="_blank">view the 1.6.6 Changes in the Wiki for more information about these changes.

If you’re using MyBB 1.6.5

 

• Download and use the https://github.com/downloads/mybb/mybb16/changed_files_1606.zip">Changed Files Package (MD5 checksum: 4bc870306925bf40643ad7550479c741)
   
  
• http://wiki.mybb.com/index.php/Upgrading#Beginning_the_Upgrade">Follow the Wiki Upgrading instructions
   
  

 

If you’re not using MyBB 1.6.5

 

• Download and use the full https://github.com/downloads/mybb/mybb16/mybb_1606.zip">1.6.6 release package (MD5 checksum: 79823144eb149fc4f89a1bcf7443a6c3)
   
  
• http://mybb.com/downloads/latest/">Follow the http://wiki.mybb.com/index.php/Upgrading#Beginning_the_Upgrade" target="_blank">Wiki Upgrading instructions
   
  

 

 

[HEADING=3]Reporting MyBB security vulnerabilities[/HEADING]

 

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our http://community.mybb.com/forum-135.html">Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

Thank you,

MyBB Team

http://blog.mybb.com/?ak_action=api_record_view&id=1536&type=feed" alt="" />

 

View the full article