Joomla! 3.9.3 Security Release announced
Joomla! 3.9.3 is a Security Release which addresses SIX security vulnerabilities.
This release also includes several improvements.
More details at the following link.
Core - Lack of URL filtering in various core components (affecting Joomla 2.5.0 through 3.9.2).
Core - Browserside mime-type sniffing causes XSS attack vectors (affecting Joomla 1.0.0 through 3.9.2).
Core - Additional warning in the Global Configuration textfilter settings (affecting Joomla 2.5.0 through 3.9.2).
Core - Stored XSS issue in the Global Configuration help url #2 (affecting Joomla 2.5.0 through 3.9.2).
Core - XSS Issue in core.js writeDynaList (affecting Joomla 2.5.0 through 3.9.2).
Core - Implement the TYPO3 PHAR stream wrapper (affecting Joomla 2.5.0 through 3.9.2).
Post Installation Message
After updating your website's Joomla! CMS you will see a message entitled:
.htaccess & web.config Security Update.
It tells you to add a few lines of code to whichever of the above files is used by your website in order to protect against MIME - type sniffing.
If hosted on Linux Apache then the file will be .htaccess.
Want to know more about MIME-type sniffing or need help editing your website's .htaccess file?
Akeeba Admin Tools PRO users
Good news if you are using Admin Tools's htaccessmaker utility to create an .htaccess file for your website.
If you have included:
- Reduce MIME - type security risks = YES
when creating your .htaccess file then your website is protected against MIME - type sniffing attacks.
We recommend that all JOOMLERS use Admin Tools PRO.
Back up before updating is highly recommended
Protect your assets.
Perform a FULL backup of your website (database and files) BEFORE updating the Joomla! CMS and/or its extensions.