News

1.3.1 released

Submitted by Chris Travers on

LedgerSMB 1.3.1 has been released. Fixes include changes to allow multi-language printing of invoices and several fixes to time cards and proiect reports.

The complete changelog is as follows:

LedgerSMB 1.3.0 Released

Submitted by Chris Travers on

The LedgerSMB development team is very proud to release LedgerSMB
1.3.0. This release continues our strong commitment to security, data
integrity, and and robustness, introducing improved functionality in
many core areas, and adding new features that many businesses will
find necessary.

1.2.25 Released

Submitted by Chris Travers on

Hi all;

LedgerSMB 1.2.25 has been released. This code has been reviewed for a
the type of SQL injection issues recently reported and all
questionable cases addressed. While some cases are believed to be
exploitable, others have been fixed as a mere precaution.

SQL injection issues on 1.2.x should generally be presumed to be
severe unless we offer reasons otherwise.

Users 1.2.x are advised to upgrade as soon as possible.

Best Wishes,
Chris Travers

1.2.21 Available for Download

Submitted by Chris Travers on

LedgerSMB 1.2.21 has been released. The complete changelog is as follows:

Changelog for 1.2.21
* Corrected a number of templates with HTML issues (Luke)
* AR/AP Aging Report fixed, ignores payment after report date (Chris T)
* Minor documentation updates (Chris T)
* Fixed bug saving SIC (Adam T)

Security advisory: Multiple Vulnerabilities

Submitted by Chris Travers on

Hi all;

It has been brought to our attention that a number of security vulnerabilities have been noted in SQL-Ledger. Several of these affect earlier versions of LedgerSMB, and three hotfixes have been released for problems that continue to affect the LedgerSMB codebase.

As always, we highly recommend testing all hotfixes before applying them to a production environment.

The CVE's mentioned here are the ones attached to SQL-Ledger. Subtle differences as to how these affect LedgerSMB are noted below.