jNews 8.5 is now available. This is a security update for all previous versions and we strongly encourage you to update your sites immediately.
This release addresses some possible vulnerability in jNews that could be used to compromise a site if attacker has a login to your site administrator area. The vulnerability was discovered by Fabio Pires, Filipe Reis, and Vitor Oliveira and of INTEGRITY Portugal.
- Bypass File Upload Restriction ( CVE-2015-7341 )
- SQL Injection ( CVE-2015-7342 )
- Cross-Site Scripting ( CVE-2015-7343 )
We also added the following enhancement and bug fixes;
- Fixed: Unable to click "Save" button when saving a List both in the admin and front-end area
- Fixed: jNews module was calling a non-existent CSS file when the module theme is set to "none".
- Fixed: Deprecated errors in the class.jmail.php and emogrifier.php
- Fixed: Unable to re-subscribe to the same list using the same email after unsubscribing
- Updated: jNews - Community Builder integration plugin to integrate to the latest CB 2
Upgrading to jNews 8.5
- In order to update to the latest version of jNews your site must be running under Joomla 3.x environment. For Joomla 2.5.x users, you can update but we do not guarantee full compatibility since we no longer perform test cases under this environment.
Joomla 1.0 and 1.5 are no longer supported.
If you purchased jNews after June 2013:
- Download the latest version of jNews from the orders page "My Orders" when you login to your joobi.co account. Take note that you have to login using your account that you used to purchase jNews.
- After downloading jNews, please login to your Joomla admin → Extensions → Manage and install over your newly downloaded file
If you purchased jNews before June 2013:
- Please contact Joobi support and supply us your order number and site URL where jNews is installed.
If you customized certain functionality in the jNews component, plugins and module, you have to backup your custom code before doing the update.
This release is freely available for users who purchased jNews license.. However, you will not be able to obtain support provided if your 1 year free support contract has expired. You have to renew your membership if you need further assistance.