[IT-SecNots] CiviCRM Security Release (5.3.1, 4.6.38) - Multiple advisories

["CiviCRM" <info AT civicrm.org>]

There has been a security release for CiviCRM. We recommend you immediately upgrade to one of the following versions:

• CiviCRM v4.6.38
• CiviCRM v5.3.1

Read the security advisories for details:

• CIVI-SA-2018-06 Reflected XSS in context parameter
• CIVI-SA-2018-05 Reflected XSS in contact merge screen
• CIVI-SA-2018-03 Reflected XSS in error message 
• CIVI-SA-2018-04 SQL injection in custom groups 
• CIVI-SA-2018-02 Reflected XSS in reports
• CIVI-SA-2018-01 SQL injection in get-cases AJAX API

A number of other issues have been fixed in these releases, as described in the official announcement. Upgrade now for the most stable CiviCRM experience (https://civicrm.org/download).

CiviCRM security announcements are available from https://civicrm.org/advisory and via the CiviCRM Security Notifications email list.

 

---

 

Click this link to unsubscribe from this mailing list.

Click this link to opt out of all mail from CiviCRM.org.

Our mailing address is:

San Francisco, 94117
United States