vBulletin 3.5.1, 3.0.10 and 2.3.8 released
 

The original purpose of this release was to provide a regular, scheduled bug-fix / service release for the new 3.5.x series, but newly discovered flaws in Internet Explorer and PHP have necessitated a security release for all three vBulletin branches.

The first flaw is in Microsoft Internet Explorer. It affects vBulletin image uploads and potentially opens a cross-site-scripting exploit. It has affected many web-based applications that allow image uploads, including phpBB and Hotmail. Although a fix from Microsoft would be preferable, we have implemented a work-around in all three branches of vBulletin to prevent the Internet Explorer flaw from being exploited.

The second flaw is in PHP and may allow the entry of unsanitized data into several areas in vBulletin. This may create security holes that are not directly caused by vBulletin, simply exploited through vBulletin as it uses affected PHP code. PHP 4.4.1 has been released to address this issue (no updated PHP5 is available yet). If you are running PHP 4, it is strongly recommended that you update your PHP installation to 4.4.1!

I'd just like to reiterate that neither of these flaws are directly related to vBulletin. Rather, they are flaws in software that ties into vBulletin. We are simply creating workarounds for these issues to prevent them from being exploited.

Patch files for vBulletin 3.5.x, 3.0.x and 2.3.x are attached to this thread, though we would recommend that you fully upgrade your board rather than simply patch it wherever possible. The zip files contain partial directory structures of the upload/ folder that would normally be found in the package you downloaded from the members' area. You should simply download the correct file for your board and extract it. Connect to your server via FTP and upload the contents of the zip file to your main board directory. This should overwrite files already on your server -- if it does not, then your board will not be patched!

All customers should upgrade or patch their boards as soon as possible.

Installing or Upgrading vBulletin (3.0.x/3.5.x)

Please see the appropriate manual sections: Installing vBulletin and Upgrading vBulletin.

Note that the process is the same as it was in the 3.0.x series. However you must redo your config.php if you are upgrading from 3.0.x!

Bug Reports (3.5.x)

You may report bugs by clicking here. Before reporting a bug, please attempt to recreate the bug on a default, uncustomized style (especially if your errors are JavaScript related). Additionally, if you have used the plugins/products system at all, please attempt to recreate the issue with the plugins system disabled!

Official Announcement: http://www.vbulletin.com/forum/showthread.php?t=161721

Great, but where are the patch attachments?

Thanks for the info, upgrading commencing.

They are there now ;)

so are there only 2 files that have changed from vb3.5 to vb 3.5.1?

No, a lot of files have been changed:

http://www.vbulletin.com/forum/showp...91&postcount=4

:( seems it may be just as fast to over right the old files with the new..
is this advisable ?

Yes, if you do not have any php edits.

[high]* Brandon Sheley trying to remeber.. i don't have many.. :D[/high]

For those having issues with class_core.php, I posted a temp. fix here :)

Can you check if replacing

with

in class_core.php fixes the problem?

With that, I somehow got an "Internal Server Error" message =/

I just upgraded my board from 3.0.9 to 3.5.1. The upgrade worked great!

Excellent, thanks for letting me know, Andreas, I'll probably upgrade my forums tonight.

<i>*cracks fingers* </i>
/me tries to remember any file edits

Get ready for loads of template changes between 3.5.0 and 3.5.1...Again!!:ermm:
(although most are minor)

great :)

so if i want to upgrade i need to redo all my hacks installed?

That depends on your version. If you are running something from the 3.5 series then there should be very few code changes made as nearly everything is plugins. If you are running 3.0 series and upgrading to either 3.0.10 or 3.5.1 then yes.

i upgraded to VB 3.5.1 last night. i have php 4.3.10 currently. do you recommend upgraded the PHP as well?

Is it really worth upgrading?i have a lot of files that i ahve edited...nd would take a whiel 2 put back on...

vb seem to update their versions so often that by the time I've finished updating my hacks yet another one will be out. I think I'll just apply the patches and wait a while.

I've decided it's good that vBulletin has frequent updates, because otherwise we would get rusty and forget how to do anything.

Awesome! The templates will be a pain though!

Will it create problems if I made manual template modifications?

yep.. i upgrade my board today... see ya later ;)

After the update the reputation on both forums (that i have) doesn't work anymore. When i want to give reputationpoints, there will be no more windowpopup, and the topic goes back up to the top of the thread

Anyone a solution for this?

All of my users are reporting that they are being logged out every few hours now even if "Remember me" is checked. Anyone else having cookie trouble with 3.5.1?

Uninstalling problems are problematic.

I've got a couple questions as I've only used this software for two months...

1) Where are templates located in the file structure - or is this a database structure?

2) Will uploading the new files overwrite the templates, if answer to 1) is file structure?

3) Are there any known plugins that get removed or cease to function do to template/file structure overwrites?

hmm, i made the template changes. and uploaded the page but my admincp still has this message

Latest version available: 3.5.1

You are currently running vBulletin version 3.5.0

Click here to download vBulletin 3.5.1 from the Members' Area
?
any thoughts

Where can we obtain the upgrade files for upgrading from 3.0.3 to 3.5.1 ?

You can just download 3.5.1 form your member area. The upgrade scripts are included.