A new version of Magento has been released. Since a potential vulnerability was fixed, we’re considering this a security fix and we recommend all Magento website owners have this upgrade done.
Magento Open Source 1.9.3.6 Release Notes (Magento.com)
This patch (SUPEE-10266) provides resolution of multiple critical security issues and several functional fixes. These critical security issues include remote code execution, cross-site scripting, and cross-site request forgery issues. We recommend upgrading your Magento store to this latest version. See Magento Security Center for a comprehensive discussion of these issues.
This release also provides support for the following functional issues:
General fixes
- We’ve fixed an issue where uploaded images were twice their original size after you applied SUPEE-9767 v2.
- We’ve added an informative message to the payment information section of the one-page checkout to alert customers that no payment is due for orders that total 0.0.
and:
SUPEE-10266 (magento.com)
SUPEE-10266, Magento Commerce 1.4.3.6 and Open Source 1.9.3.6 contain multiple security enhancements that help close cross-site request forgery (CSRF), unauthorized data leak, and authenticated Admin user remote code execution vulnerabilities. These releases also include fixes for issues with image reloading and payments using one-step checkout.
Patches and upgrades are available for the following Magento versions:
- Magento Commerce 1.9.0.0-1.14.3.4: SUPEE-10266 or upgrade to Magento Commerce 1.14.3.6
- Magento Open Source 1.5.0.0-1.9.3.4: SUPEE-10266 or upgrade to Magento Open Source 1.9.3.6
Magento version 1.9.3.5 was skipped.
The previous release was on July 12, 2017.
Our Website Maintenance Department will be in contact with our clients regarding this upgrade. If you need this upgrade done on your website, please contact us.
-Tony
