Joomla Extended Support

Joomla has decided to issue support for releases to 2 years now instead of just 18 months. This is how it looks now:

• Version 2.5: March 2012 (long term support release)
• Version 3.0: September 2012
• Version 3.1: March 2013
• Version 3.2: September 2013
• Version 3.5: March 2014 ((long term support release)
• Version 4.0: September 2014
• Version 4.1: March 2015
• Version 4.2: September 2015
• Version 4.5: March 2016 ((long term support release)

Here's an updated graphic showing the Joomla Roadmap:

Joomla 2.5 will be supported until March 2014 (from March 2012 to March 2014 total) but it's being predicted that the support will go longer - maybe even up to a year longer (so into 2015 possibly). You can see those predictions here:

How upcoming changes may affect your Joomla upgrade schedule (anything-digital.com)

The first two release are called Standard Term Support (STS) releases and are supported for 6 months.

Every third release in this cycle is called a Long Term Support (LTS) release. An LTS release is intended to be very stable and is supported until the next LTS is released.

This gives each major Joomla version a lifetime of approximately 18 24 months. For most users, a Joomla upgrade is recommend only from one LTS to another LTS.

We're happy that there's extended support and it makes sense. It's mature software that was rewritten from the ground up. There is a huge community of users, too.

Stay tuned to our support blog for more Joomla updates.

-Tony

Joomla 3.0.3 Released

If you are using the 3.0.x version of Joomla, then you should upgrade. At this time, none of our clients are since the 2.5.x version is still being actively developed and used. The 3.0.x version is not a major version of Joomla since the x.5 versions are.

Joomla 3.0.3 Released (joomla.org)

The Joomla Project is pleased to announce the immediate availability of Joomla 3.0.3. This is a security release. The Production Leadership Team's goal is to continue to provide regular, frequent updates to the Joomla community.

What is the fix?

"Undefined variable caused information disclosure in some situations."

Upgrades / Contact Webstix

If you want the upgrade done to your website, please contact Webstix.

-Tony

Joomla 2.5.9 Released

A new version of Joomla is out and it takes care of a security issue. Everyone using Joomla 2.5.x should upgrade their core Joomla software as soon as possible.

Joomla 2.5.9 Released (joomla.org)

The Joomla Project is pleased to announce the immediate availability of Joomla 2.5.9. This is a security release. The Production Leadership Team's goal is to continue to provide regular, frequent updates to the Joomla community. Learn more about Joomla! development at the Developer Site.

From Secunia Security Advisories:

TITLE:
Joomla! Multiple Information Disclosure Vulnerabilities

SECUNIA ADVISORY ID:
SA52043

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/52043/

RELEASE DATE:
2013-02-05

DISCUSS ADVISORY:
http://secunia.com/advisories/52043/#comments

DESCRIPTION:
Multiple vulnerabilities have been reported in Joomla!, which can be exploited by malicious people to disclose potentially sensitive information.

1) An error related to the method of encoding search terms can be exploited to disclose certain information.

This vulnerability is reported in the 2.5.x versions prior to 2.5.9 and in the 3.0.x versions prior to 3.0.3.

2) An error due to an undefined variable can be exploited to disclose
certain information.

3) Certain coding errors can be exploited to disclose certain information.

The vulnerabilities #2 and #3 are reported in the 3.0.x versions prior to 3.0.3.

SOLUTION:
Update to version 2.5.9 or 3.0.3.

What is the fix?

"Undefined variable caused information disclosure in some situations."

Upgrades / Contact Webstix

Clients who are on our Joomla upgrade program will receive an email from our staff notifying them that we will perform the upgrade. If you are not on the program and want the upgrade done to your website, please contact Webstix.

-Tony

WordPress 3.5.1

The fine folks at WordPress have released a new version. It's a maintenance and security release and a minor release. Below, you'll find more information about this release.

You should have your version of WordPress upgraded as soon as possible. If you need help, please contact our website maintenance department today. If you are looking for automatic updates to WordPress, then you might want to consider our WordPress Upgrade Program.

WordPress 3.5.1 Maintenance and Security Release (wordpress.org)

WordPress 3.5.1 is now available. Version 3.5.1 is the first maintenance release of 3.5, fixing 37 bugs. It is also a security release for all previous WordPress versions. For a full list of changes, consult the list of tickets and the changelog, which include:

• Editor: Prevent certain HTML elements from being unexpectedly removed or modified in rare cases.
• Media: Fix a collection of minor workflow and compatibility issues in the new media manager.
• Networks: Suggest proper rewrite rules when creating a new network.
• Prevent scheduled posts from being stripped of certain HTML, such as video embeds, when they are published.
• Work around some misconfigurations that may have caused some JavaScript in the WordPress admin area to fail.
• Suppress some warnings that could occur when a plugin misused the database or user APIs.

Additionally, a bug affecting Windows servers running IIS can prevent updating from 3.5 to 3.5.1. If you receive the error “Destination directory for file streaming does not exist or is not writable,” you will need to follow the steps outlined on the Codex.

WordPress 3.5.1 also addresses the following security issues:

• A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We’d like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work.
• Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team.
• A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue.

Please contact Webstix if you need any help or assistance.

-Tony