Drupal 4.7.8 and 5.3 are now available for download. These are maintenance releases that fix problems reported using the bug tracking system, as well as some security vulnerabilities.

Upgrading your existing Drupal sites is strongly recommended.

Download

• Download Drupal 5.3.
• Download Drupal 4.7.8.

There are no new features in these installments. For more information about the Drupal 4.7.x release series, please consult the Drupal 4.7.0 release announcement. For more information about the Drupal 5.x release series, consult the Drupal 5.0 release announcement.

Changelog

The full list of changes between the 4.7.7 and 4.7.8 releases can be found by reading the 4.7.8 release notes. A complete list of all bug fixes in the stable DRUPAL-4-7 branch can be found at http://drupal.org/project/cvs/3060/?branch=DRUPAL-4-7.

The full list of changes in between the 5.2 and 5.3 releases can be found by reading the 5.3 release notes. A complete list of all bug fixes in the stable DRUPAL-5 branch can be found at http://drupal.org/project/cvs/3060/?branch=DRUPAL-5.

Security vulnerabilities

Drupal 4.7.8 and Drupal 5.3 fix several security vulnerabilities. Details can be found in the official security advisories:

1. DRUPAL-SA-2007-024
2. DRUPAL-SA-2007-025
3. DRUPAL-SA-2007-026
4. DRUPAL-SA-2007-029
5. DRUPAL-SA-2007-030

To fix these security problems, you can either (1) upgrade Drupal or (2) patch Drupal.

We recommend you do the full upgrade as the patches do not contain the many additional bugfixes that went into the releases. Applying the patches will leave your site in a somewhat unversioned state, but at least secure.

If you prefer to patch Drupal, consult the information below.

• To fix the security issue in Drupal 4.7.7, use the patches below:
  • http://drupal.org/files/sa-2007-024/SA-2007-024-4.7.7.patch
  • http://drupal.org/files/sa-2007-026/SA-2007-026-4.7.7.patch
  • http://drupal.org/files/sa-2007-030/SA-2007-030-4.7.7.patch
• To fix the security issues in Drupal 5.2, use the patches below:
  • http://drupal.org/files/sa-2007-024/SA-2007-024-5.2.patch
  • http://drupal.org/files/sa-2007-025/SA-2007-025-5.2.patch
  • http://drupal.org/files/sa-2007-026/SA-2007-026-5.2.patch
  • http://drupal.org/files/sa-2007-029/SA-2007-029-5.2.patch
  • http://drupal.org/files/sa-2007-030/SA-2007-030-5.2.patch

Security infrastructure

We have a security announcement mailing list, a history of all security advisories, and an RSS feed with the most recent security advisories. We strongly advise Drupal administrators to sign up for the list.

Bug reports

Both Drupal 4.7.x and 5.x branches are being maintained, so given enough bug fixes (not just bug reports) more maintenance releases will be made available.

Drupal version: Drupal 4.7.xDrupal 5.x