The LedgerSMB core team is proud to announce the release of 1.3.43, the latest in the mature 1.3 release line. This release provides a number of relatively minor fixes and enhancements. From here on out, 1.3 releases are expected periodically when needed, but not with significant frequency.
The changelog for 1.3.43 is:
15 September 2014, London. The LedgerSMB project - all-volunteer developers and contributors - today announced LedgerSMB 1.4.0.
The LedgerSMB team is proud to release version 1.3.42. This release corrects a couple of significant issues and a number of more minor issues.
Most significantly this corrects an issue which prevented posting of foreign currency payments when certain conditions regarding rounded, converted amounts were present. Also this corrects an issue where invoices with ship-to addresses were sometimes linked to incorrectly in the reports.
A number of more minor fixes were included as well.
The complete changelog is below:
LedgerSMB 1.3.41 has been released.
It includes a single fix to the single payment workflow which caused an error in some cases while paying invoices.
This release has a couple of sales tax fixes, a database schema fix and a couple of others. Highly recommend upgrading at earliest opportunity.
Changelog for 1.3.40
What follows is a slightly edited version of a post to the email lists. While LedgerSMB does not directly utilize OpenSSL, it is usually deployed on web servers that do. No upgrades of LedgerSMB are required, but you may need to update the security libraries of your web server. Please read further for the sorts of implications this has regarding LedgerSMB and what we would recommend about mitigating and recovering from risks.
Security Advisory: LedgerSMB < 1.3.36, Improper Logout on Some Browsers
Severity: Low (cvssv2 base score: 3.6, total 0.5)
Remotely Exploitable: No
Complexity of Attack: High
Impact: Relatively low.
Prerequisite for Attack: Physical Access to Previously Logged In Browser, so high complexity in most cases.
Attack Vector: Physical, against client.
Impact: The attacker may gain access unexpectedly to LedgerSMB using the client's previous credentials.
Background