[IT-SecNots] CiviCRM Security Release for 4.4 & 4.5

["CiviCRM" <info AT civicrm.org>]

An important security update is being released for both the latest version of CiviCRM and the long-term-support version. We recommend you upgrade immediately to maintain the security of your site.

For more information on the security issues see:

• CIVI-SA-2015-001 - Arbitrary file read

• CIVI-SA-2015-002 - Reflected XSS in AJAX callbacks

• CIVI-SA-2015-003 - Persistent XSS in Drupal watchdog integration

• CIVI-SA-2015-004 - Malicious Smarty file naming

• CIVI-SA-2015-005 - SQL Injection in CiviMail Backend

 

A number of other issues have been fixed in these releases. Upgrade now for the most stable CiviCRM experience.

CiviCRM security announcements are available from https://civicrm.org/advisory and via the CiviCRM Security Notifications email list.

Go to the website | Unsubscribe from this mailing | Subscribe to this mailing | Opt out of all mailings

Click this link to unsubscribe from this mailing list.

Click this link to opt out of all mail from CiviCRM.org.

Our mailing address is:

San Francisco, CA 94117
United States