7

I have some software that I want to upgrade to improve security. The current version I'm on is 2.6.2. Is it better to upgrade to the latest version of the entire product line which is 2.8 or should I upgrade to the latest version of my current product which is 2.6.7?

Improve this question
1
  • Version 2.6.7 is extremely likely to be safer than 2.6.2, as it may contain (security) bug fixes as per the common understanding of that versioning scheme. (Of course, it may also introduce new bugs, but that is less likely in such a release.) Version 2.8 will probably be safer as well, but may not always be what you want, as it’s more likely to change features and behavior. You will eventually have to switch to 2.8, though, because the software vendor may drop support for older versions (such as 2.6), stop tracking (security) bugs for those older releases, etc.
    – caw
    Commented Nov 10, 2018 at 23:41

2 Answers 2

Reset to default
8

There is no absolute, consensual and systematic convention for versioning. Every vendor numbers his successive product versions as he sees fit. I mean, even Microsoft decided that the next version after "2000" was "XP", followed by "Vista", then "7", then "2008". I do not know what logic this follows, but I doubt it is from Earth.

Usually, vendors try to adhere to a scheme where products have releases (each new release possibly making some substantial changes with regards to the previous release) and releases have sub-versions which are limited to bugfixes, including (most importantly) security fixes. Hence, my wild guess is that upgrade to version "2.6.7" of your software should fix security issues which are known to impact version "2.6.2" (if there are any), but not bring any new feature, and should (hopefully) be easy to apply. On the other hand, upgrading to version "2.8" is switching to a new product line, with new features, and this may break compatibility with the rest of your system, which has been configured to talk with version 2.6.

Note that some vendors of widespread software do not follow such a scheme. In particular, Web browser vendors (in the case of, at least, Firefox and Chrome) tend to follow the simpler scheme known as "use the latest version or die". Version numbers are then meaningless integers whose only merit is to be bigger than the version number of the competitors (fortunately, there is no shortage of natural integers).

But you really should see what the vendor documents about his versioning system, since each vendor has his own conventions. As @RoryAlsop explains, this documentation can take several forms, including changelogs; and, of course, testing is paramount: don't upgrade any critical system until you have some good indications that the new version actually does the job...

Improve this answer
1
  • 2
    One thing to note that if the naming convention is really as you suggest, it might be important to check if the vendor is still supporting the 2.6 line with bug fixes and such.
    – user10211
    Commented Sep 3, 2012 at 1:22
6

This will entirely depend on what has been changed in those versions.

I would expect that you will have performance fixes, security fixes etc - which would make it a good idea to upgrade - but you may also have new functionality added in, which could add security vulnerabilities.

So, read the changelogs for the versions between where you are and the latest one (or talk to the vendor to see what changes have been made), check out cvsdetails for any known vulnerabilities, and then, if appropriate test the upgrade to make sure it doesn't break anything.

Then run a penetration test against it - and if that comes out okay, upgrade.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .