vBSEO Security Bulletin - vBSEO 3.3.2 Released

Originally Posted by Mert Gökçeimam

As this is a security update we'll not supply detailed change log within this release.



Thanks for the notice , corrected

You said that there are further more bug fixes with this release. So other than that security bug fix, what more has been fixed?

Originally Posted by hydn

What's the difference between the patch and the version upgrade as far as file changes?

the upgrade includes the patch + a couple bug fixes that have been reported and addressed since 3.3.1.

I notice only two files changed in the patch download.

Correct. Older versions patch is only 2 files to replace.

Originally Posted by Chroder

How "potentially serious" is this? Can we have some details?

Due to the nature of it being an security release, we will not share any details about the issue in public.

The exploit is serious. We recommend everyone upgrade or patch all of their sites Immediately.

My server admin has dropped off the face of the planet, and apparently the credentials have changed. I need to know if I have to disable vBSEO until I can get access.

Open a ticket if you need our help. We will assist you with getting everything in order ASAP. I would not suggest disabling vBSEO ever, but if you can't get this addressed soon, it might be the safest thing to do.

will upgrade tonight after work

Originally Posted by Mert Gökçeimam

As this is a security update we'll not supply detailed change log within this release.

Sorry, I think you misunderstood. I'm not asking for the changelog to the security update. I'm aware its two files and could compare old and new to see changes.

What I was asking for is the change log for the following:

3.3.2 also includes bugs that has been discovered within vBSEO 3.3.1

Sorry about the mix up.

I'll try and sort it out tonight after work. I suppose I could use vB's plugin system to upload a php shell and then dump the database and files that way. Then I can move the site to my own server.

Would be a whole lot easier if the server admin emailed me back!

Anyway -- thanks, Brian, for the clarification.

Hello Hayden ,

As it is an important security release , we didn't prepare a detailed list for the bug fixes. The bugs that had been reported are mainly located within vBSEO SEO Plugin - Bug Reporting at vBSEO.com. I suggest you check that forum for the time being as our current top priority is supporting our users patching their forums correctly.

upgraded without problems thanks

Originally Posted by Mert Gökçeimam

Hello Hayden ,

As it is an important security release , we didn't prepare a detailed list for updated bug fixess. The bugs that had been reported are mainly located within vBSEO SEO Plugin - Bug Reporting at vBSEO.com I suggest you check that forum for the time being as our current top priority is supporting our users patching their forums correctly.

No prob on not having the official list yet. Just wanted to be informed on how different the upgrade is from patching only. Looking thought bug reports now.

Thanks much!

As this is a 'point' release, there are no new features in 3.3.2. Bug fixes to current features only + the security fix.

Originally Posted by Brian Cummiskey

As this is a 'point' release, there are no new features in 3.3.2. Bg fixes to current features only + the security fix.

I was running 3.3.0 so I downloaded the patch to upgrade to 3.3.2, unzipped it, uploaded the files overwriting what was on the server. I went to admincp and logged into the vbseo control panel to see if I needed to copy over an ID # or something but the ID# was green.

The issue I have is that my site still reports itself to be 3.3.0, no 3.3.2

Did I miss something?

Hello Ken ,

There are two methods to patch your forum.

1. Applying the patch only, this will stop the security hole, it will not update your vBSEO version.

2. Upgrading to vBSEO 3.3.2


In your case you chose to apply the patch. That will not change the version you are running. If you want to upgrade to vBSEO 3.3.2 ( we suggest to do so ) you should follow the upgrade instructions that come with the 3.3.2 package.

Performed a full upgrade from 3.3.0 and went flawlessly. Thanks. I see in the EDIT POST Ajax page the text for the save button is now SAVE rather than DELETE. Should have upgraded to 3.3.1 before I guess.

Thanks for a great product; I'll be using you guys for vb 4.0 as well.

Originally Posted by KenDude

I was running 3.3.0 so I downloaded the patch to upgrade to 3.3.2, unzipped it, uploaded the files overwriting what was on the server. I went to admincp and logged into the vbseo control panel to see if I needed to copy over an ID # or something but the ID# was green.

The issue I have is that my site still reports itself to be 3.3.0, no 3.3.2

Did I miss something?

Hi Ken,
The patches DO NOT upgrade the board to 3.3.2. They will remain the same version, with the fix applied.

If you want to UPGRADE to 3.3.2, you need to download the full 3.3.2 package from the https://www.vbseo.com/downloads/ area, and performa a normal upgrade (ftp files, + install product file + visit vbseocp.php and save new key).

Originally Posted by beet

Performed a full upgrade from 3.3.0 and went flawlessly. Thanks. I see in the EDIT POST Ajax page the text for the save button is now SAVE rather than DELETE. Should have upgraded to 3.3.1 before I guess.

Thanks for a great product; I'll be using you guys for vb 4.0 as well.

Hi Beet,

yes, the Save/Delete bug was fixed some time ago. Glad you are working now and we look forward to having you on board through vb4

upgraded without problems... thank you !