Urgent security releases now available for all version of sh404SEF

During the Thanksgiving holiday weekend, Anything Digital LLC was informed of a long-standing and serious security issue affecting all versions of sh404SEF for both Joomla 1.0 and Joomla 1.5.

This blind SQL injection and reflective cross-site scripting vulnerability evaded their scanners and had to be sniffed out by their colleague and Joomla security expert Jeff Channel (web site | Twitter).

Once Anything Digital LLC was informed of the situation, their development and testing teams shook off the lethargy of the holiday celebrations and sprang into action. In just 48 hours, the team produced a comprehensive set of patches and upgrades that were tested thoroughly and released this morning.

Since this vulnerability affects existing versions of sh404SEF, all users are strongly urged to upgrade without delay.

For most people, simply downloading and installing the most recent commercial version (2.1.8) will be sufficient. However, version-specific details for commercial and non-commercial versions are available:

• Joomla 1.5 & sh404SEF v2.x
• Joomla 1.5 & sh404SEF v1.5.x
• Joomla 1.5 & sh404SEF v.1.0.20 beta
• Joomla 1.0 & sh404SEF 1.x

Due to the widespread nature of this vulnerability, Yannick has broken the lock on his sh404SEF build archive and we are happy to provide no-charge patches/upgrades for all Joomla 1.0 users and those using sh404SEF v1.0.20 beta, the last cost-free version of sh404SEF for Joomla 1.5

Anything Digital sincerely apologizes for any inconvenience. 

Comments (0)

Subscribe to this comment's feed

Write comment

Name

Email

Website

Title

Comment

smaller | bigger

Subscribe via email (registered users only)

I have read and agree to the Terms of Usage.

Add Comment Preview