• OzzModz is no longer taking registrations. All registrations are being redirected to Snog's Site
    All addons and support is available there now.

XenForo.com XenForo 2.3.9 (inc XFMG) & 2.2.18 Released (Security Fix)

Ozzy47

Ozzy47

Administrator
Today we are releasing XenForo 2.3.9 to address some potential security vulnerabilities that were recently reported to us. This version only includes security fixes and any bug fixes we previously said would make it to 2.3.9 have now been delayed until 2.3.10.

It is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.3 upgrade to this release to benefit from increased stability.

The issues identified are as follows:
  • Prevention of a possible stored XSS (cross-site scripting) exploit related to BB code rendering (thank you to Antisocial)
  • Prevention of a possible XSS exploit related to lightbox usage in posts (thank you UwU)
  • Prevention of a possible RCE (remote code execution) exploit via authenticated, but malicious, admin users (thank you UwU)
If you are a XenForo Cloud customer, fixes for these issues have been rolled out automatically, and no further action is required to address them.

We recommend doing a full upgrade to resolve the issue, but a patch can be applied manually. See below for further details.
  • Download 239-patch.zip
  • Extract the .zip file
  • Upload the contents of the upload directory to the root of your XenForo installation
  • Rebuild master data by logging in to your install URL, or running xf:rebuild-master-data on the command line
Note: If you decide to patch the files instead of doing full upgrades, your "File health check" will report these files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area or upgrade from your Admin control panel (Tools > Check for upgrades...).

Directly from your admin control panel

If you are a XenForo Cloud customer, your installations have already been patched and no further action is required. You will remain on version 2.3.8 until 2.3.10 is released.

The following public templates have had changes:
  • attachment_macros
  • bb_code_tag_attach
  • lightbox_macros
Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

As always, new releases of XenForo are free to download for all customers with active licenses. You may now upgrade from your admin control panel or grab the new version from the customer area.
Please note that XenForo 2.3 has higher system requirements than earlier versions.

The following are minimum requirements:
  • PHP 7.2 or newer (PHP 8.3 recommended)
  • MySQL 5.7 and newer (Also compatible with MariaDB/Percona etc.)
  • All of the official add-ons require XenForo 2.3.
  • Enhanced Search requires at least Elasticsearch 7.2.
Full details of how to install and upgrade XenForo can be found in the XenForo manual. We strongly recommend upgrading directly from within your control panel.

Attachments​

Last edited by a moderator: Friday at 12:04 AM
  • Like
  • Love
Reactions: STIJL, geekgasm, thedude and 18 others
Written by
Company info
There is no better platform upon which to grow your community.

Engage your customers with the premium community experience.
Staff member
  • Messages
    707
  • Reaction score
    24,942
  • Points
    503

XenForo 2.2.18 has also been released. Please refer to the release notes above. Only two of the three security issues apply to XenForo 2.2.18. The stored XSS is not applicable.

We recommend doing a full upgrade to resolve the issue, but a patch can be applied manually. See below for further details.
  • Download 2218-patch.zip
  • Extract the .zip file
  • Upload the contents of the upload directory to the root of your XenForo installation
Note: If you decide to patch the files instead of doing full upgrades, your "File health check" will report these files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

Attachments​

  • Like
  • Love
Reactions: Wildcat Media, Fabian and Shuya

XenForo Media Gallery 2.3.9 Released​

Today we are also releasing Media Gallery 2.3.9 to address a failing template modification caused by a change in 2.3.9. This is now available to download in the customer area, one-click upgrades, and being rolled out to XenForo Cloud automatically.
  • Like
Reactions: hIBEES, misantropino, Neal and 1 other person

2.3.9 patch files for pre-XF 2.3.8 installs​

Some users may struggle to apply the patch on pre-2.3.8 installs. If you are patching 2.3.7 or earlier you may try this patch.

Attachments​

  • Like
  • Love
Reactions: hIBEES, Aaratech, Matthew S and 4 others

Continue reading...
 
You must log in or register to reply here.
Back
Top