Answers.Body: <p>I'm guessing the advisory will be posted any moment, but you should be able to go to 4.6.12 instead of jumping to 4.7. I believe the 4.6.x branch is now a LTS branch so you don't need to go to 4.7 immediately.</p>
  <p><strong>Update:</strong> The advisories have been updated (shortly after I posted) and also an email has been sent to the security list (<a href="https://civicrm.org/receive-security-advisories" rel="nofollow noreferrer">subscribe here</a>):</p>
  <blockquote>
  <p>This is a notification of a security release for CiviCRM. We recommend
  you immediately upgrade to a secure version of CiviCRM.</p>
  <p>The most recent releases are CiviCRM 4.7.1 or CiviCRM 4.6.12. 4.4.21
  LTS has been released also.</p>
  <p>Some fixes affecting security were included in CiviCRM 4.6.10 and
  4.6.11, but the email announcements which should accompany such releases was omitted. So, we're releasing 4.6.12 to time with a
  security release window and ensure subscribers get notified.</p>
  <p>Read the security advisories for details of the various fixes included
  in the latest CiviCRM builds:</p>
  <ul>
  <li><a href="https://civicrm.org/advisory/civi-sa-2015-010-version-information-disclosure" rel="nofollow noreferrer">https://civicrm.org/advisory/civi-sa-2015-010-version-information-disclosure</a></li>
  <li><a href="https://civicrm.org/advisory/civi-sa-2015-011-reflected-xss-in-error-message" rel="nofollow noreferrer">https://civicrm.org/advisory/civi-sa-2015-011-reflected-xss-in-error-message</a></li>
  <li><a href="https://civicrm.org/advisory/civi-sa-2016-01-path-disclosure" rel="nofollow noreferrer">https://civicrm.org/advisory/civi-sa-2016-01-path-disclosure</a></li>
  <li><a href="https://civicrm.org/advisory/civi-sa-2016-02-access-bypass" rel="nofollow noreferrer">https://civicrm.org/advisory/civi-sa-2016-02-access-bypass</a></li>
  <li><a href="https://civicrm.org/advisory/civi-sa-2016-03-multiple-vulnerabilties-in-dompdf" rel="nofollow noreferrer">https://civicrm.org/advisory/civi-sa-2016-03-multiple-vulnerabilties-in-dompdf</a></li>
  </ul>
  <p>A number of other non-security issues have also been fixed in the
  latest releases. Upgrade now for the most stable CiviCRM experience.</p>
  <p>CiviCRM security announcements are available from
  <a href="https://civicrm.org/advisory" rel="nofollow noreferrer">https://civicrm.org/advisory</a> and via the CiviCRM Security
  Notifications email list.</p>
  <p>CiviCRM.org, San Francisco, CA 94117 United States</p>
  </blockquote>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-02-03T17:59:02.770Z
Answers.LastActivityDate: 2016-02-04T15:51:35.133Z
Answers.LastEditDate: 2020-06-17T09:00:50.810Z
Answers.UserDisplayName: Laryn
Body: <p>Just upgraded a site to 4.6.11 (long story as to why).</p>
  
  <p>CiviCRM is showing the "Security update required", which links to <a href="https://civicrm.org/advisory" rel="nofollow">https://civicrm.org/advisory</a></p>
  
  <p>As I click on advisory after advisory, in reverse chronological order starting from "CIVI-SA-2015-011: REFLECTED XSS IN ERROR MESSAGE", <em>all</em> have been fixed prior to 4.6.11.</p>
  
  <p>So ... what is the vulnerability then, if I don't upgrade to 4.7.1?</p>
  
Tags: <upgrade><security><4.6.11>
Title: How do I tell what security issues require upgrade?
ThreadText: # How do I tell what security issues require upgrade?
  
  (Asked by: username_0 on 2016-02-03)
  
  Just upgraded a site to 4.6.11 (long story as to why).
  
  CiviCRM is showing the "Security update required", which links to <https://civicrm.org/advisory>
  
  As I click on advisory after advisory, in reverse chronological order starting from "CIVI-SA-2015-011: REFLECTED XSS IN ERROR MESSAGE", *all* have been fixed prior to 4.6.11.
  
  So ... what is the vulnerability then, if I don't upgrade to 4.7.1?
  
  **Tags:** upgrade, security, 4.6.11
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-02-03. Score: 3 | Accepted answer
  
  I'm guessing the advisory will be posted any moment, but you should be able to go to 4.6.12 instead of jumping to 4.7. I believe the 4.6.x branch is now a LTS branch so you don't need to go to 4.7 immediately.
  
  **Update:** The advisories have been updated (shortly after I posted) and also an email has been sent to the security list ([subscribe here](https://civicrm.org/receive-security-advisories)):
  
  > This is a notification of a security release for CiviCRM. We recommend
  > you immediately upgrade to a secure version of CiviCRM.
  >
  > The most recent releases are CiviCRM 4.7.1 or CiviCRM 4.6.12. 4.4.21
  > LTS has been released also.
  >
  > Some fixes affecting security were included in CiviCRM 4.6.10 and
  > 4.6.11, but the email announcements which should accompany such releases was omitted. So, we're releasing 4.6.12 to time with a
  > security release window and ensure subscribers get notified.
  >
  > Read the security advisories for details of the various fixes included
  > in the latest CiviCRM builds:
  >
  > * <https://civicrm.org/advisory/civi-sa-2015-010-version-information-disclosure>
  > * <https://civicrm.org/advisory/civi-sa-2015-011-reflected-xss-in-error-message>
  > * <https://civicrm.org/advisory/civi-sa-2016-01-path-disclosure>
  > * <https://civicrm.org/advisory/civi-sa-2016-02-access-bypass>
  > * <https://civicrm.org/advisory/civi-sa-2016-03-multiple-vulnerabilties-in-dompdf>
  >
  > A number of other non-security issues have also been fixed in the
  > latest releases. Upgrade now for the most stable CiviCRM experience.
  >
  > CiviCRM security announcements are available from
  > <https://civicrm.org/advisory> and via the CiviCRM Security
  > Notifications email list.
  >
  > CiviCRM.org, San Francisco, CA 94117 United States
  
  
  ---
  
  