Security Patch Released for vBulletin 6.X and 5.7.5

[glennrocksvb]

The API functionality of vBulletin 6 and 5.7.5 has been found to have security vulnerabilities. Please see the vBulletin official announcement:

https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4491049-security-patch-released-for-vbulletin-6-x-and-5-7-5

I recommend applying the security patch ASAP!

• If you are on vBulletin 5.7.4 and older, I recommend upgrading to vB 5.7.5 Patch Level 3. Follow the normal full upgrade process.
• If you are on vBulletin 5.7.5 Patch Level 2 and older, I recommend applying the Patch Level 3 patch.
  1. Upload the files to your server. Overwriting the existing files with the new ones.
  2. Run the upgrade script (core/install/upgrade.php) that is included in the patch to rebuild your templates.
• If you are on vBulletin 6.0.2 and older, I recommend upgrading to vB 6.0.3 Patch Level 1. Follow the normal full upgrade process.
• If you are on vBulletin 6.0.3, I recommend applying the Patch Level 1 patch.
  1. Upload the files to your server. Overwriting the existing files with the new ones.
  2. Run the upgrade script (core/install/upgrade.php) that is included in the patch to rebuild your templates.

If you need help applying the patch or performing a full upgrade, please contact me.

[glennrocksvb]

I have applied the security patch on this site.

Wayne Luke mentioned in the release notes "to run the upgrade script to rebuild your templates". I'm caching my templates so as an additional step, I also turned off template caching and then turned it back on. I'm not sure if that's needed. But I did it just to be sure.

[Mrs.T]

On 23 Mar one of our members reported that they had a malware warning from Malwarebytes for our forum which is on Cloud. I couldn’t query it as I was abroad at the time.

Do you think it was likely this issue that caused it? I know nothing about Malwarebytes.

[glennrocksvb]

I'm not sure. And I don't know the details of the security vulnerabilities that were patched. vBulletin normally doesn't disclose for security reasons.

What was the Malwarebytes warning message?

[Mrs.T]

I don’t know, he just said he got a malware warning.

will have to see if it happens again.

thanks anyway