It had been possible for a remote attacker to extract a remotely hosted archive while you had been extracting a backup archive / installing an update, depending on your server settings. The attack was not possible at any other time. Merely having Joomla installed had not made your site vulnerable.
This vulnerability affects the following application versions:
- Joomla 2.5.4
- Joomla 2.5.5
- Joomla 2.5.6
- Joomla 2.5.7
- Joomla 2.5.8
- Joomla 2.5.9
- Joomla 2.5.10
- Joomla 2.5.11
- Joomla 2.5.13
- Joomla 2.5.14
- Joomla 2.5.15
- Joomla 2.5.16
- Joomla 2.5.17
- Joomla 2.5.18
- Joomla 2.5.19
- Joomla 2.5.20
- Joomla 2.5.21
- Joomla 2.5.22
- Joomla 2.5.23
- Joomla 2.5.24
- Joomla 2.5.25
- Joomla 2.5.26
- Joomla 3.0.0
- Joomla 3.0.1
- Joomla 3.0.2
- Joomla 3.0.3
- Joomla 3.0.4
- Joomla 3.1.0
- Joomla 3.1.1
- Joomla 3.1.4
- Joomla 3.1.5
- Joomla 3.1.6
- Joomla 3.2.0
- Joomla 3.2.1
- Joomla 3.2.2
- Joomla 3.2.3
- Joomla 3.2.4
- Joomla 3.2.5
- Joomla 3.2.6
- Joomla 3.3.0
- Joomla 3.3.1
- Joomla 3.3.2
- Joomla 3.3.3
- Joomla 3.3.4
- Joomla 3.3.5