The Arcive of Official vBulletin Modifications Site.

vB.Org System · #1 10-07-2009, 09:20 PM

vBulletin 3.8.4 PL1 / 3.7.6 PL1 / 3.6.12 PL2

An XSS flaw within the user profile page has recently been discovered. This could allow an attacker to carry out an action as a user or obtain access to a user's account. To resolve this issue, it has been necessary to release a patch level version of the active versions of vBulletin.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.

Upgrading from 3.8.4, 3.7.6 or 3.6.12

If you are already running the latest version of the 3.6, 3.7 or 3.8 branch, the process you will be required to follow to make your board immune to this flaw is very simple.

There is no need to run an upgrade script if you are already running the latest version.

Visit the Patches section of the vBulletin Members' Area and download the patch for the version you are using, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.

Upgrading from an earlier version

If you are not already running the latest version of 3.6, 3.7 or 3.8, you should download the latest version from the Members' Area and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available here.

Download vBulletin 3.8.4 PL1 / 3.7.6 PL1 / 3.6.12 PL2

As usual, the version released today is available for all customers with valid, active licenses to download from the vBulletin Members' Area.

vBulletin Members Area

More...

TNCclubman · #2 10-07-2009, 10:37 PM

thanks installed.... no mods broken.

Brandon Sheley · #3 10-07-2009, 10:38 PM

will upgrade soon
thanks

ubcforums · #4 10-08-2009, 03:40 PM

should I patch if I use 3.8.3 ?
Thanks

steve1966 · #5 10-08-2009, 03:53 PM

many thanks

TNCclubman · #6 10-08-2009, 03:57 PM

any 3.8 users must now upgrade to vB3.8.4 pl1 if you want to secure your board. if you're not using vB3.8.4, download the entire vB from the members area, run the upgrade script, dont just upload the 3 files.

ubcforums · #7 10-08-2009, 03:58 PM

Quote:

Originally Posted by TNCclubman

any 3.8 users must now upgrade to vB3.8.4 pl1 if you want to secure your board. if you're not using vB3.8.4, download the entire vB from the members area, run the upgrade script, dont just upload the 3 files.

thanks for reply

Dj Smuggla · #8 10-08-2009, 04:29 PM

Have you got to edit the files in any way or just upload them?

cheat-master30 · #9 10-08-2009, 04:34 PM

Updated, and all is working fine. To the last person... just upload said files.

Dj Smuggla · #10 10-08-2009, 04:37 PM

Thanks m8, all is working fine...

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.04403 seconds Memory Usage 2,252KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (1)ad_showthread_firstpost (1)ad_showthread_firstpost_sig (1)ad_showthread_firstpost_start (1)bbcode_quote (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)navbar (4)navbar_link (120)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (10)post_thanks_box (10)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (10)post_thanks_postbit_info (10)postbit (10)postbit_onlinestatus (10)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start pagenav_page pagenav_complete tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages:

The Arcive of Official vBulletin Modifications Site.

It is not a VB3 engine, just a parsed copy!