5 Aug 2015

MAGENTO Security Announcement

Install New Security Patch Immediately
Dear Magento Provider,

Today, we are releasing a patch (SUPEE-6482) that addresses 4 security issues identified through our comprehensive security program. This patch resolves two issues related to APIs and two cross-site scripting risks. There are no confirmed reports of attacks related to these issues to-date, but it is important that you work immediately with your clients to deploy the patch in order to protect their stores. More information about these issues is provided in the Appendix of the Magento Enterprise Edition and Magento Community Edition user guides. You can also sign up for future security alerts at the Magento Security Center.

We have created patches for both Magento Enterprise and Magento Community Editions. For Magento Enterprise Edition, a patch is available for Enterprise Edition 1.7 and later releases and will be part of the core code of Enterprise Edition 1.14.2.1, which is set to launch on August 6. For Magento Community Edition, a patch is available for Community Edition 1.4 and later releases and is part of the core code of Community Edition 1.9.2.1, which is now available for download. Please work with your clients to deploy the patch or upgrade to the latest Enterprise Edition or Community Edition release.

DOWNLOADING THE SECURITY PATCH
Before implementing this new security patch (SUPEE-6482), your clients must first implement all previous security patches. This will ensure that the patch works properly.

To download the patch, choose from the following options:
Enterprise Edition Merchants: Go to My Account, select the Downloads tab, and then navigate to Magento Enterprise Edition > Support Patches. Look for the folder titled “Security Patches – August 2015.” Merchants can also upgrade to Enterprise Edition 1.14.2.1 and receive the security fixes as part of the core code.
Community Edition Merchants: Patches for earlier versions of Community Edition can be found on the Community Edition download page (look for SUPEE-6482). Merchants can also upgrade today to Community Edition 1.9.2.1 and receive the security fixes as part of the core code.
Be sure to implement and test the patch in a development environment first to confirm that it works as expected before deploying it to a production site. Information about installing patches for Magento Enterprise Edition and Magento Community Edition is available online.

Thank you for your attention and continued support.

Best regards,
The Magento Team

Author: Harshal Shah

Harshal Shah is CEO & Founder of Xhtmljunkies, Located in Gujarat, India, XHTML Junkies is one of the best companies that offer unique eCommerce solutions by the virtue of its dedicated professionals. Our professionals are extremely proficient in offering development services pertaining to eCommerce. You can find Harshal on Google+ and Twitter.