MyBB 1.4.1 is a general maintenance release and a security update to the MyBB 1.4 series. It fixes medium and low risk security vulnerabilities. We recommend everybody upgrades to this release immediately or patches their boards with the manual patching instructions below.

These vulnerabilities affect MyBB 1.4 and previous releases of MyBB 1.2 (including 1.2.14). Older versions of MyBB may also be affected. Please see the post below for upgrade instructions for 1.2.14.

WDZ is credited with the discovery of these vulnerabilities.

MyBB 1.4 to MyBB 1.4.1 Patch
This patch is only for users running MyBB 1.4. If you are running an older version of MyBB then please download MyBB 1.4.1 from the MyBB site and update to it.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.

[attachment=10604]

If you wish to manually patch your board please download "mybb_1400_patches.txt" and follow the instructions in that file.

[attachment=10579]

For the upgrade of 1.4 to 1.4.1, the upgrader IS required -- this is so that templates may be updated. The manual patch set instructions only fix the medium risk vulnerabilities and is only made available to temporarily secure your forum until you have time to run the complete upgrade. We strongly recommend updating as soon as possible.

Reporting MyBB security vulnerabilities
If you think you've found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we've had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

Posted on Sun, 17 Aug 2008 02:55:52 -0500 at http://community.mybboard.net/thread-36022.html