Gallery 3.0.4 Security Release Available

After several extensive internal and external security audits which discovered 22 distinct vulnerabilities, we are releasing Gallery 3.0.4 as a security release. All of the issues require that someone with malicious intent either have an account with edit permissions, or trick a user with edit permissions into clicking on a malicious link. In most cases, this can only lead to a possible XSS vulnerability, but in several instances it allows arbitrary PHP code execution.

We thank the following individuals for reporting these issues: Chalk, Mateusz Goik, James 'albino' Kettle, Emanuel Bronshtein, and Sergey Markov. Due to their efforts, they will each be receiving bounties of $1000 for their help in making Gallery more secure. 

We recommend that all users of Gallery 3 upgrade as soon as possible.

For complete details on this release including what changed, please refer to the official news story:

http://gallery.menalto.com/gallery_3_0_4

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
__[ g a l l e r y - a n n o u n c e ]_________________________

[ UNSUBSCRIBE? --> http://lists.sourceforge.net/lists/listinfo/gallery-announce ]
[ list info/archive --> http://gallery.sourceforge.net/lists.php ]
[ gallery info/FAQ/download --> http://gallery.sourceforge.net ]