Difference between revisions of "Security hotfixes for Joomla EOL versions/en"
From Joomla! Documentation
(Importing a new version from external source) |
(Updating to match new version of source page) |
||
| (8 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
<noinclude><languages /></noinclude> | <noinclude><languages /></noinclude> | ||
| − | {{Warning|'''Do not rely on all security issues being patched or reported for EOL (end of life) versions.'''}} | + | {{Warning|title=Warning! |
| − | {{Joomla version|version={{ | + | |'''Do not rely on all security issues being patched or reported for EOL (end of life) versions.'''}} |
| + | {{Joomla version|version={{CurrentSTSVer5|maintenance}}|comment=is the current version}} | ||
This page is for Joomla! versions which have reached EOL('''end of life''') and are no longer being developed or supported by the Joomla! project. Issues and items are only listed on this page as a benefit to the users of EOL versions who have not migrated to a supported version yet. | This page is for Joomla! versions which have reached EOL('''end of life''') and are no longer being developed or supported by the Joomla! project. Issues and items are only listed on this page as a benefit to the users of EOL versions who have not migrated to a supported version yet. | ||
It is '''strongly recommended you update your websites''' to a supported Joomla! version ASAP. | It is '''strongly recommended you update your websites''' to a supported Joomla! version ASAP. | ||
__NOTOC__ | __NOTOC__ | ||
| + | == Joomla! 3== | ||
| + | |||
| + | ==== 20 February 2024 ==== | ||
| + | * There were several security issues found in Joomla 3. Here is a list of the issues: | ||
| + | ** Read the [https://developer.joomla.org/security-centre/929-20240205-core-inadequate-content-filtering-within-the-filter-code.html Announcement] for details on the issue in Joomla! 3.7.0 - 5.0.2. | ||
| + | ** Read the [https://developer.joomla.org/security-centre/927-20240203-core-xss-in-media-selection-fields.html Announcement] for details on the issue in Joomla! 1.6.0 - 5.0.2. | ||
| + | ** Read the [https://developer.joomla.org/security-centre/926-20240202-core-open-redirect-in-installation-application.html Announcement] for details on the issue in Joomla! 1.5.0 - 5.0.2. | ||
| + | ** Read the [https://developer.joomla.org/security-centre/925-20240201-core-insufficient-session-expiration-in-mfa-management-views.html Announcement] for details on the issue in Joomla! 3.4.0 - 5.0.2. | ||
| + | * There is an installable patch for all known (these and previous) security issues for Joomla! 3.10.12 provided by Tom van der Laan from TLWebdesign for FREE. This patch is not tested nor endorsed by the Joomla! Security Task Force: [https://github.com/TLWebdesign/Joomla-3-EOL-Security-Fixes Joomla! 3 EOL Security Fixes]. | ||
| + | * You could also enroll in the paid ELTS program that will provide the same security fix as above but as a Joomla Update: [https://elts.joomla.org Joomla ELTS Program]. | ||
| + | |||
| + | ==== 30 November 2023 ==== | ||
| + | * Read the [https://developer.joomla.org/security-centre/919-20231101-core-exposure-of-environment-variables.html Announcement] for details on the issue in Joomla! 1.6 - 4.4.0 and 5.0.0. | ||
| + | * There is an installable patch for the same issue in Joomla! 3.10.12 provided by Tom van der Laan from TLWebdesign for FREE. This patch is not tested nor endorsed by the Joomla! Security Task Force: [https://github.com/TLWebdesign/Joomla-3.10.12-languagehelper-hotfix Joomla 3.10.12 Language Helper Hotfix]. | ||
| + | * You could also enroll in the paid ELTS program that will provide the same security fix as above but as a Joomla Update: [https://elts.joomla.org Joomla ELTS Program]. | ||
| + | |||
== Joomla! 2.5== | == Joomla! 2.5== | ||
| − | ==== 14 December 2016 ==== | + | ==== 14 December 2016 ==== |
* Read the [https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html Announcement] for details on the issue in Joomla! 3.6.4 and before. | * Read the [https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html Announcement] for details on the issue in Joomla! 3.6.4 and before. | ||
* There is an installable patch for the same issue in Joomla! 2.5 provided by the VirtueMart team. This patch is not tested nor endorsed by the Joomla! Security Task Force: [https://virtuemart.net/news/latest-news/478-joomla-security-release-3-6-5-and-patch-for-joomla-2-5-28 14th December 2016 Issue Patch]. | * There is an installable patch for the same issue in Joomla! 2.5 provided by the VirtueMart team. This patch is not tested nor endorsed by the Joomla! Security Task Force: [https://virtuemart.net/news/latest-news/478-joomla-security-release-3-6-5-and-patch-for-joomla-2-5-28 14th December 2016 Issue Patch]. | ||
| Line 32: | Line 49: | ||
There is a security issue in all versions of Joomla! related to unauthorized file uploads. | There is a security issue in all versions of Joomla! related to unauthorized file uploads. | ||
* Read the [http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=31626 Issue Tracker Item] for details. | * Read the [http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=31626 Issue Tracker Item] for details. | ||
| − | * Download the | + | * Download the joomlacode.org/gf/download/trackeritem/31626/83528/UploadFix15v3.zip File Upload Security Patch (link dead) and manually apply per instructions. |
:'''File Upload Security Patch Update Instructions:''' | :'''File Upload Security Patch Update Instructions:''' | ||
:#Download & Unpack the security patch | :#Download & Unpack the security patch | ||
:#Upload patch files via ftp directly to the root of your Joomla! installation, overwriting existing files. | :#Upload patch files via ftp directly to the root of your Joomla! installation, overwriting existing files. | ||
| + | |||
===Flash Uploader=== | ===Flash Uploader=== | ||
The flash uploader has been removed from Joomla! 2.5 and Joomla! 3 for security reasons. 1.5 users should do the same and can do so first by removing the file and then by setting the option for it to off. | The flash uploader has been removed from Joomla! 2.5 and Joomla! 3 for security reasons. 1.5 users should do the same and can do so first by removing the file and then by setting the option for it to off. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
<noinclude> | <noinclude> | ||
| Line 52: | Line 63: | ||
[[Category:Joomla! 1.5]] | [[Category:Joomla! 1.5]] | ||
[[Category:Joomla! 2.5]] | [[Category:Joomla! 2.5]] | ||
| + | [[Category:Joomla! 3.x]] | ||
</noinclude> | </noinclude> | ||
Latest revision as of 02:32, 25 February 2024
Warning!
Do not rely on all security issues being patched or reported for EOL (end of life) versions.
Joomla!
5.1.0
is the current version
This page is for Joomla! versions which have reached EOL(end of life) and are no longer being developed or supported by the Joomla! project. Issues and items are only listed on this page as a benefit to the users of EOL versions who have not migrated to a supported version yet.
It is strongly recommended you update your websites to a supported Joomla! version ASAP.
Joomla! 3
20 February 2024
- There were several security issues found in Joomla 3. Here is a list of the issues:
- Read the Announcement for details on the issue in Joomla! 3.7.0 - 5.0.2.
- Read the Announcement for details on the issue in Joomla! 1.6.0 - 5.0.2.
- Read the Announcement for details on the issue in Joomla! 1.5.0 - 5.0.2.
- Read the Announcement for details on the issue in Joomla! 3.4.0 - 5.0.2.
- There is an installable patch for all known (these and previous) security issues for Joomla! 3.10.12 provided by Tom van der Laan from TLWebdesign for FREE. This patch is not tested nor endorsed by the Joomla! Security Task Force: Joomla! 3 EOL Security Fixes.
- You could also enroll in the paid ELTS program that will provide the same security fix as above but as a Joomla Update: Joomla ELTS Program.
30 November 2023
- Read the Announcement for details on the issue in Joomla! 1.6 - 4.4.0 and 5.0.0.
- There is an installable patch for the same issue in Joomla! 3.10.12 provided by Tom van der Laan from TLWebdesign for FREE. This patch is not tested nor endorsed by the Joomla! Security Task Force: Joomla 3.10.12 Language Helper Hotfix.
- You could also enroll in the paid ELTS program that will provide the same security fix as above but as a Joomla Update: Joomla ELTS Program.
Joomla! 2.5
14 December 2016
- Read the Announcement for details on the issue in Joomla! 3.6.4 and before.
- There is an installable patch for the same issue in Joomla! 2.5 provided by the VirtueMart team. This patch is not tested nor endorsed by the Joomla! Security Task Force: 14th December 2016 Issue Patch.
Remote Code Execution
There is a security issue in Joomla! from Joomla 1.5 up until 3.4.5 related to remote code execution. This was followed up with some longer term fixes in Joomla 3.4.7
21 December 2015
- Read the Security Centre for details.
- Download the Session Hardening Patch and manually apply per instructions.
Joomla! 1.5
Although Joomla! 1.5 has reached EOL(end of life), if there is a critical security issue with a fix it may be reported here.
Remote Code Execution
There is a security issue in Joomla! from Joomla 1.5 up until 3.4.5 related to remote code execution. This was followed up with some longer term fixes in Joomla 3.4.7
21 December 2015
- Read the Security Centre for details.
- Download the Session Hardening Patch and manually apply per instructions.
File Upload Security Patch
There is a security issue in all versions of Joomla! related to unauthorized file uploads.
- Read the Issue Tracker Item for details.
- Download the joomlacode.org/gf/download/trackeritem/31626/83528/UploadFix15v3.zip File Upload Security Patch (link dead) and manually apply per instructions.
- File Upload Security Patch Update Instructions:
- Download & Unpack the security patch
- Upload patch files via ftp directly to the root of your Joomla! installation, overwriting existing files.
Flash Uploader
The flash uploader has been removed from Joomla! 2.5 and Joomla! 3 for security reasons. 1.5 users should do the same and can do so first by removing the file and then by setting the option for it to off.