vBulletin 3.5.5 Released
 

As posted at vBulletin.com: vBulletin 3.5.5 Released

vBulletin 3.5.5

Following the internal discovery of a potential cross-site scripting flaw, we have decided to put out a preventative security release in order to close the hole before it is exploited.

Although vBulletin 3.6.0 is also released today, we understand that some customers may be reluctant to upgrade immediately to the new version, those people should upgrade to 3.5.5 or use the provided patch to secure their vBulletin installation as soon as possible.

Updating your vBulletin to combat the XSS flaw:

Our primary recommendation for customers is to upgrade to vBulletin 3.6.0, but if you are not ready to do this, you can do one of the following:

1. Full Upgrade: The best way to fix the problem is to perform a full upgrade, downloading the complete 3.5.5 package from the vBulletin Members' Area and following the regular upgrade instructions.
2. Patch: A second option is to download the patch files discussed in this thread and upload them to your web server, overwriting the existing files. The patch is available in the Members' Area patch page. If you are not running 3.5.4, you must upgrade completely or use the plugin!
3. Plugin: The plugin system built into vBulletin 3.5 allows the problem to be fixed with a simple plugin. The install file for this plugin is also attached to this thread and is the easiest way to fix the problem, as it does not require you to upload any files via FTP. The plugin will be automatically removed when you perform your next full upgrade. You can install the plugin by following the instructions here.

Read more at vBulletin.com

Thanks, upgrading now... :)

upgrading now thank you

On installing the plugin version; should "allow overwrite" be checked as yes or no?

thanks

It shouldn't matter, but really it should be no as you wont have already imported that plugin.

Decisions, decisions....

Upgrade to 3.5.5 just to make sure my hacks work on this version, then to 3.6
or to just go straight to 3.6....

I am currently running 3.5.4

If I install just the patch or plugin will I still be on version 3.5.4 or will I be now on 3.5.5?

There is a hack I want to use that works for 3.5.5 but not 3.5.4.

Also, If I want can I jump straigh to 3.6 or do i need to upgrade to 3.5.5 first?

During the 3.6 upgrade process it will bump your version up to 3.5.5, 3.6.0 beta (1, 2, 3, 4), 3.6.0 (RC1, 2, 3), and finally 3.6.0. So you don't need to do any manual upgrading prior to upgrading to 3.6.

wow, just upgraded!