vBulletin 3.6.7 Released
 

vBulletin 3.6.7

As much as we hate to spring another upgrade on you all so soon after the release of vBulletin 3.6.6, an XSS flaw was identified today and in order to maintain our commitment to fix security problems as soon as we become aware of them, we have to release 3.6.7 and a patch for older versions.

All versions of vBulletin 3.6 prior to 3.6.7 are vulnerable to the XSS. vBulletin 3.5.x and 3.0.x are not affected.

To minimize the pain of another upgrade, there are no changed templates since 3.6.6 and no database schema changes, so the upgrade should be as simple and quick as possible.

Since we have fixed several bugs since vBulletin 3.6.6 was released, these fixes are also incorporated in this version and include amongst others:

• RTL support for date picker popup
• Fixed HTML for archive forum lists
• MySQL error while merging users fixed
• Smilie parsing error fixed
• PHP 5.0.5 errors fixed
• Hard-coded image paths fixed

A complete list of bugs fixed in the 3.6 branch is available in the project manager.

Please accept our apologies for bringing out a new version just days after the previous release. We're sorry.

Fixing the XSS Bug

The XSS problem can be resolved in one of three ways.

1. Full Upgrade: The best way to fix the problem is to perform a full upgrade, downloading the complete 3.6.7 package from the vBulletin Members' Area and following the regular upgrade instructions. This is the only option that will not only fix the XSS issue, but will also apply all the bug fixes made since the release of 3.6.6.
2. Patch: A second option is to download the patch files either in the Members' Area or attached to this thread and upload them to your web server, overwriting the existing files.
   Patch file: 366_patch.zip
3. Plugin: The plugin built into vBulletin 3.6 allows the problem to be fixed with a simple plugin. The install file for this plugin is also attached to this thread and is the easiest way to fix the problem, as it does not require you to upload any files via FTP. The plugin will be automatically removed when you perform your next full upgrade. You can install the plugin by following the instructions here.
   Plugin File: vb_calendar366_css_fix_plugin.xml

Please note the following:

• The plugin can be used with any previous version of vBulletin 3.6
• The patch can only be applied to vBulletin 3.6.4, 3.6.5 or 3.6.6
• You may perform a full upgrade to vBulletin 3.6.7 from any previous version of vBulletin 3.

You can read more at the original thread on vBulletin.com: vBulletin 3.6.7 Released

aww upgrading again. oh well thanks :D

Yippee.. another upgrade! :)

Thanks, upgrading now... :)

Arg! I will upgrade Web City again. https://vborg.vbsupport.ru/

upgrading :)

Ok installed and running. Regards

Ah! I just upgrade my forum today & now planning to sleep :(. Gosh they don't sleep & let us sleep :p.. Anyway upgrading now.

Ug!

_V

Oh dear :(

Best fix sooner rather than later though eh

Can you attach the plugin to this thread?

for some reason i dont see any attachments...

Go to http://www.vbulletin.com/forum/showthread.php?t=229950 for attachments.

aww, another upgrade :(

This site is not for supporting direct upgrades of vBulletin... you have to go to the official website, have your license updated...

-- please other members, don't fall in the trick of a request... if the guy does not see the attachments, it is because he is not licensed... not us to deal with that

I just added the plug in...whoelse did this?

Just did the plugin as well. Still at 3.6.4
At this rate, I can wait till 3.7.

I haven't even upgraded to 3.6.6 yet! :mad:

I have put the plugin on for now, full upgrade either later tonight or tomorrow, as I have half a dozen code changes to make and I have to be in the mood. :D

is this a friggin joke

Don't think so!

I'm staying on 3.6.5 for the time being (it works fine, so I'm not going to stuff around with it). Not to mention all the mods and template edits I've made. When I take a week off work in a couple of months, I will think about upgrading then. :(

Do i have to install all the files in the upload folder ? Can you just tell me what changed so i can only upload them ones ?

DM

http://www.vbulletin.com/forum/showp...29&postcount=3

Ill just overwrite these ones

DM I doubt that anyone except the developers know exactly what changed in each file. This is why I hardly ever use hacks that require me to edit the php files. You're going to run into this everytime.

i just used the plugin

Upgraded to 3.6.7 last night & waiting for 3.6.8 http://img503.imageshack.us/img503/7449/yikesft3.gif

Ive learned a big lesson here after the 3.6.6 update i had 10 Templates that needed updated things seemed to be working fine and i went in to the templates and had no idea what was going on so i just sweep them under the rug ,,,, in the mean time i made some minor changes here and there and 3 of the 10 left the que at the time i was like cool ..... Well then today all **** hit the fan cant stay logged in and last vistied date was like 5 years ago all forums showing read ARGHHHHHHHH so i upgraded to the 3.6.7 with the quickness and it didnt fix anything , so then i cowboyed up and started clicking around in the out of date templates and finnaly learned how to read the compairison thing then i updated the remaining 7 templates this way and my site took off Speed wise and things got better how ever i still have some issues and i cant get the 3 templates back on there to run the compairison thing so i can make the changes , I have ran the check for out dated templates and nothing I have also un installed vbSEO as i couldnt get it to work on my server cause of .htaccess issues My boards sitill a little messed up Loging out users and intermittingly messing up the last vistited witch effects the forums read feature , Hoping for version 4.0 and all templates get edited so i can catch them 3 back up , Ive been in touch with the .com peeps and they want me to Revert all templates ...LOL yeah right thats like a last ditch effort thing .

To any newbies like me out there DO NOT ignore the Out of Date Templates

DM

Sometimes you have to learn the hard way ;)

Well With your Help I backed up before i installed the 3.6.7 So I have 2 back ups one right before the 3.6.5 upgrade , PM me on DB about how to apply a back up if i have to ;)

Upgrade my test boards and working again to update all my free skins from 3.6.4 to 3.6.7 opps!!

...

Installed easily :)

To all the people who said they're not bothering to update....they DID read the part about the WHOLE 3.6.x line having the same flaw right? It didn't just crop up in 3.6.6 it goes all the way back to the initial gold release....I hope people are patching at the very least and 3am has me reading most of page 2 wrong :p

thanks.upgrading...

Installed patch and .xml file. Ive messed my site up two many times to try something now, so ill wait to upgrade.:)

Cool, I love upgrading

I agree, there's nothing more satisfying than updating scores of templates (in my case 85). :)

Please don't post assumptions on things you know nothing about. You might want to remember that unlicensed members cannot post in this forum.

Web City Forum Online upgrade completed succesfully, one time again! https://vborg.vbsupport.ru/

I learned the hard way to keep a roster of all "Hacks" installed, marking the ones that require php.file edits in "large bold red text" ;)


_V

thanks,
hope that no more critical bugs will be on! (at least for next month)