Security advisory (fixed in 1.3.37)

Submitted by Chris Travers on

Security Advisory: LedgerSMB < 1.3.36, Improper Logout on Some Browsers

Severity:  Low (cvssv2 base score: 3.6, total 0.5)
Remotely Exploitable: No
Complexity of Attack:  High
Impact:  Relatively low.
Prerequisite for Attack:  Physical Access to Previously Logged In Browser, so high complexity in most cases.
Attack Vector:  Physical, against client.
Impact:  The attacker may gain access unexpectedly to LedgerSMB using the client's previous credentials.

Background

1.3.37 released

Submitted by Chris Travers on
LedgerSMB 1.3.37 has been released.  This is a significant release with a number of important fixes including two security fixes (please stay tuned for security advisories on these two usually-minor security issues).

LedgerSMB 1.3.35 released

Submitted by Chris Travers on

 

 LedgerSMB 1.3.35 has been released.  This release includes a fairly large number of relatively minor fixes, as well as the addition of invoice creation date tracking and a number of fixes for locale-specific requirements.  If you are having any issues with the bugs fixed, you should upgrade immediately.  

LedgerSMB 1.3.34 released

Submitted by ehu on
he LedgerSMB team has released 1.3.34.  Although this is a bugfix release with some significant fixes in it, it also includes a few minor enhancements, such as the ability to search for drafts and batches without specifying a type.
 
The complete changelog is as follows:

LedgerSMB 1.3.33 released

Submitted by Chris Travers on

LedgerSMB 1.3.33 has been released.  This release corrects a number of minor issues, the most major one is that format_amount() was not working on the check printing workflows.

A fairly large number of other minor bugs were also fixed.  Those who are wondering whether to upgrade probably should do so, as the issues fixed are all relatively minor.  The complete changelog is below.

LedgerSMB 1.3.32 released

Submitted by Chris Travers on

LedgerSMB 1.3.32 has been released.  This release adds overlooked functionality, and corrects a number of minor to moderate problems with previous releases.  Those who are running 1.3.31 should upgrade sooner rather than later.  Others should upgrade after reviewing the 1.3.31 inventory changes.

LedgerSMB 1.3.30 released

Submitted by ehu on

LedgerSMB 1.3.30 has been released. This release includes a number of additional CSS hooks, some fixes to database-level interfaces for re-opening books, and a number of other minor changes. Unless you have specific need for any of the fixes, this is a fairly minor release and is not normally required as an upgrade. The complete changelog is below.

Best wishes,
Chris Travers

LedgerSMB 1.3.29 released

Submitted by ehu on

LedgerSMB 1.3.29 has been released and contains a significant number of fixes and if these fixes affect you, you may want to upgrade to this or a higher version.  Please note that 1.3.31 has some significant bugfixes in it, and consequently we will be recommending that everyone move to this version or higher when it comes out.

 
The changelog for 1.3.29 is below.
 
Subscribe to