September 2025 - devel - lists.freelock.com

Bug#1112641: ledgersmb: FTBFS with Perl 5.42: Possible precedence problem between ! and pattern match (m//)
by Niko Tyni 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.2 Severity: important Tags: ftbfs forky sid User: debian-perl(a)lists.debian.org Usertags: perl-5.42-transition This package fails to build with Perl 5.42 (currently in experimental.) https://perl.debian.net/rebuild-logs/perl-5.42-throwaway/ledgersmb_1.6.33+d… # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: marktext() called with non string first argument; resetting scan (consider using maketext('') directly!' # at t/07.1-extract-perl.t line 102. # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: Direct variable interpolation not supported; use bracketed ([_1]) syntax for '$form->{title}'!' # at t/07.1-extract-perl.t line 102. # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: Direct variable interpolation not supported; use bracketed ([_1]) syntax for '$b->{c}'!' # at t/07.1-extract-perl.t line 102. # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: Direct variable interpolation not supported; use bracketed ([_1]) syntax for '$b->{c}'!' # at t/07.1-extract-perl.t line 102. # Looks like you failed 4 tests of 21. t/07.1-extract-perl.t ........... Dubious, test returned 4 (wstat 1024, 0x400) Failed 4/21 subtests [...] Test Summary Report ------------------- t/07.1-extract-perl.t (Wstat: 1024 (exited 4) Tests: 21 Failed: 4) Failed tests: 2-3, 13, 16 Non-zero exit status: 4 Files=20, Tests=1802, 17 wallclock secs ( 0.31 usr 0.08 sys + 13.40 cusr 2.23 csys = 16.02 CPU) Result: FAIL make[1]: *** [Makefile:474: test] Error 1 If you want to test changes against Perl 5.42 in experimental and run into uninstallability problems, there is a test repository of rebuilt Debian sid packages for amd64 available at <https://perl.debian.net/>. Thanks for your work on Debian, -- Niko Tyni ntyni(a)debian.org

3 2

Bug#1082804: ledgersmb: FTBFS (test failure) if building as root
by наб 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.2 Severity: serious Tags: ftbfs Justification: fails to build from source Dear Maintainer, During a ratt run for src:ossp-uuid I got 2024/09/26 17:23:23 Building package 71 of 123: ledgersmb 2024/09/26 17:26:55 building ledgersmb failed: exit status 2 Full log attached, but the interesting bit is make[1]: Leaving directory '/<<PKGBUILDDIR>>' dh_auto_test make -j24 test make[1]: Entering directory '/<<PKGBUILDDIR>>' make[1]: git: No such file or directory /bin/sh: 1: lsb_release: not found prove t/ # Failed test 'use LedgerSMB::PSGI;' # at t/01-load.t line 231. # Tried to use 'LedgerSMB::PSGI'. # Error: Running a Web Service as root is a security problem. # If you are starting LedgerSMB as a system service, # please make sure that you drop privileges as per README.md # and the example files in conf/. # The method of passing a --user argument to starman cannot # be used as starman drops privileges too late, starting us as root. at /<<PKGBUILDDIR>>/lib/LedgerSMB/PSGI.pm line 42. # Compilation failed in require at t/01-load.t line 231. # BEGIN failed--compilation aborted at t/01-load.t line 231. # Looks like you failed 1 test of 209. t/01-load.t ..................... Dubious, test returned 1 (wstat 256, 0x100) Failed 1/209 subtests (less 5 skipped subtests: 203 okay) Name "Config::IniFiles::ledgersmb.conf" used only once: possible typo at /usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm line 60. t/02-number-handling.t .......... ok Per my reading of the policy, each d/rules target may be run as root? Best, -- System Information: Debian Release: 12.4 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.1.0-12-amd64 (SMP w/24 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled

3 4

Bug#1104577: ledgersmb: preinst fails, calls adduser without Pre-Depend-ing on it
by Chris Hofstaedtler 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.33+ds-2.2 Severity: serious User: reproducible-builds(a)lists.alioth.debian.org Usertag: toolchain Your package has a preinst maintainer script, calling adduser. At the same time, your package Depends: adduser, but does not Pre-Depends: adduser. Installing your package fails when adduser is not yet configured. Reproducer: $ mmdebstrap --variant=essential --include=ledgersmb unstable /dev/null ... Selecting previously unselected package ledgersmb. Preparing to unpack .../211-ledgersmb_1.6.33+ds-2.2_all.deb ... warn: `/etc/adduser.conf' does not exist. Using defaults. Insecure $ENV{PATH} while running with -T switch at /usr/share/perl5/Debian/AdduserLogging.pm line 161. dpkg: error processing archive /tmp/apt-dpkg-install-Z6hj5d/211-ledgersmb_1.6.33+ds-2.2_all.deb (--unpack): new ledgersmb package pre-installation script subprocess returned error exit status 25 Errors were encountered while processing: /tmp/apt-dpkg-install-Z6hj5d/211-ledgersmb_1.6.33+ds-2.2_all.deb E: Sub-process env returned an error code (1) You may consider replacing adduser with a sysusers fragment, see https://manpages.debian.org/unstable/debhelper/dh_installsysusers.1.en.html Otherwise, please Pre-Depend on adduser. Best, Chris

2 1

Bug#1062845: ledgersmb: CVE-2024-23831
by Salvatore Bonaccorso 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-2+deb11u3 Hi, The following vulnerability was published for ledgersmb. CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-q… [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c012… Regards, Salvatore

2 2

Bug#1029045: ledgersmb: login page Perl error in default config
by JB 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.9+ds-2+deb11u3 Severity: important X-Debbugs-Cc: j-dbug.666.114.1101(a)x.firehead.org Dear Maintainer, I installed LedgerSMB with defaults on Debian-11 with systemd. It starts fine with Starman, but when I go to http://localhost:5762/login.pl it shows only this message: ----- Error! Can't locate object method "new" via package "Template" at /usr/share/ledgersmb/bin/../lib/LedgerSMB/Template.pm line 599. dbversion: , company: 1.6.9 ----- Thus leaving the package in an unusable state. -- System Information: Debian Release: 11.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-20-amd64 (SMP w/2 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages ledgersmb depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.77 ii dpkg 1.20.12 ii libcarp-always-perl 0.16-1 ii libcgi-emulate-psgi-perl 0.23-1 ii libcgi-simple-perl 1.115-2 ii libclass-c3-xs-perl 0.15-1+b1 ii libconfig-inifiles-perl 3.000003-1 ii libdata-uuid-perl 1.226-1+b1 ii libdatetime-format-strptime-perl 1.7800-1 ii libdatetime-perl 2:1.54-1 ii libdbd-pg-perl 3.14.2-1+b1 ii libdbi-perl 1.643-3+b1 ii libhtml-escape-perl 1.10-1+b3 ii libhttp-exception-perl 0.04007-1 ii libio-stringy-perl 2.111-3 ii libjs-dojo-dijit 1.15.4+dfsg1-1+deb11u1 ii libjson-perl 4.03000-1 ii liblocale-codes-perl 3.66-1 ii liblocale-maketext-lexicon-perl 1.00-1.1 ii liblog-log4perl-perl 1.54-1 ii libmime-lite-perl 3.031-1 ii libmime-types-perl 2.18-1 ii libmoose-perl 2.2014-2 ii libmoosex-nonmoose-perl 0.26-1.1 ii libnamespace-autoclean-perl 0.29-1 ii libnumber-format-perl 1.75-1.1 ii libpgobject-perl 2.2.0-1 ii libpgobject-simple-perl 3.000002-1.1 ii libpgobject-simple-role-perl 2.000002-1.1 ii libpgobject-type-bigfloat-perl 2.001-1 ii libpgobject-type-bytestring-perl 1.2.3-1 ii libpgobject-type-datetime-perl 2.000002-1 ii libpgobject-util-dbadmin-perl 1.4.0-1 ii libpgobject-util-dbmethod-perl 1.00.003-1 ii libplack-builder-conditionals-perl 0.05-1.1 ii libplack-middleware-reverseproxy-perl 0.16-1 ii libplack-perl 1.0048-1 ii libplack-request-withencoding-perl 0.14-1 ii libtemplate-perl 2.27-1+b3 ii libtext-markdown-perl 1.000031-3 ii libtry-tiny-perl 0.30-1 ii libversion-compare-perl 0.14-1.1 ii libxml-simple-perl 2.25-1 ii perl 5.32.1-4+deb11u2 ii postgresql-client 13+225 ii postgresql-client-13 [postgresql-client] 13.9-0+deb11u1 ii postgresql-contrib 13+225 ii starman 0.4015-1 ii ucf 3.0043 Versions of packages ledgersmb recommends: pn libjson-xs-perl <none> pn liblatex-driver-perl <none> pn libmath-bigint-gmp-perl <none> pn libtemplate-plugin-latex-perl <none> pn libtex-encode-perl <none> ii lighttpd 1.4.59-1+deb11u2 pn texlive-latex-recommended <none> Versions of packages ledgersmb suggests: pn default-mta | mail-transport-agent <none> pn latex-cjk-all <none> pn libimage-size-perl <none> pn libopenoffice-oodoc-perl <none> pn libx12-parser-perl <none> pn lpr <none> ii postgresql 13+225 pn texlive-xetex <none> -- debconf information: * ledgersmb/lsmb_proxy: Lighttpd * ledgersmb/admin_login: lsmb_dbadmin

2 1

Bug#1028924: ledgersmb: Init script calls start-stop-daemon incorrectly, fails to start
by JB 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.9+ds-2+deb11u3 Severity: important X-Debbugs-Cc: j-dbug.666.114.1101(a)x.firehead.org Dear Maintainer, I installed LedgerSMB with defaults on Debian-11 with sysvinit (instead of systemd). When I try to start the daemon, it produces the following output: # /etc/init.d/ledgersmb start $Starting ledgersmb: start-stop-daemon: unrecognized option '--interval=5' Try 'start-stop-daemon --help' for more information. # I am not an expert on start-stop-daemon, but looking at the init script, it seems start-stop-daemon is invoked with /usr/bin/start_server as the intended program to run, which then has further arguments for that to start /usr/bin/starman. However the start-stop-daemon invocation lacks a "--start" argument prior to the /usr/bin/start_server, and the "--start" seems to be the norm among other uses of start-stop-daemon in the system's /etc/init.d/* files. So maybe the init script is for some completely different version of start-stop-daemon, or the arguments are really for a different program, or something. I'm not quite sure. -- System Information: Debian Release: 11.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'oldstable-updates'), (500, 'stable'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-20-amd64 (SMP w/2 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: sysvinit (via /sbin/init) LSM: AppArmor: enabled Versions of packages ledgersmb depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.77 ii dpkg 1.20.12 ii libcarp-always-perl 0.16-1 ii libcgi-emulate-psgi-perl 0.23-1 ii libcgi-simple-perl 1.115-2 ii libclass-c3-xs-perl 0.15-1+b1 ii libconfig-inifiles-perl 3.000003-1 ii libdata-uuid-perl 1.226-1+b1 ii libdatetime-format-strptime-perl 1.7800-1 ii libdatetime-perl 2:1.54-1 ii libdbd-pg-perl 3.14.2-1+b1 ii libdbi-perl 1.643-3+b1 ii libhtml-escape-perl 1.10-1+b3 ii libhttp-exception-perl 0.04007-1 ii libio-stringy-perl 2.111-3 ii libjs-dojo-dijit 1.15.4+dfsg1-1+deb11u1 ii libjson-perl 4.03000-1 ii liblocale-codes-perl 3.66-1 ii liblocale-maketext-lexicon-perl 1.00-1.1 ii liblog-log4perl-perl 1.54-1 ii libmime-lite-perl 3.031-1 ii libmime-types-perl 2.18-1 ii libmoose-perl 2.2014-2 ii libmoosex-nonmoose-perl 0.26-1.1 ii libnamespace-autoclean-perl 0.29-1 ii libnumber-format-perl 1.75-1.1 ii libpgobject-perl 2.2.0-1 ii libpgobject-simple-perl 3.000002-1.1 ii libpgobject-simple-role-perl 2.000002-1.1 ii libpgobject-type-bigfloat-perl 2.001-1 ii libpgobject-type-bytestring-perl 1.2.3-1 ii libpgobject-type-datetime-perl 2.000002-1 ii libpgobject-util-dbadmin-perl 1.4.0-1 ii libpgobject-util-dbmethod-perl 1.00.003-1 ii libplack-builder-conditionals-perl 0.05-1.1 ii libplack-middleware-reverseproxy-perl 0.16-1 ii libplack-perl 1.0048-1 ii libplack-request-withencoding-perl 0.14-1 ii libtemplate-perl 2.27-1+b3 ii libtext-markdown-perl 1.000031-3 ii libtry-tiny-perl 0.30-1 ii libversion-compare-perl 0.14-1.1 ii libxml-simple-perl 2.25-1 ii perl 5.32.1-4+deb11u2 ii postgresql-client-13 [postgresql-client] 13.9-0+deb11u1 ii postgresql-contrib 13+225 ii starman 0.4015-1 ii ucf 3.0043 Versions of packages ledgersmb recommends: ii apache2 2.4.54-1~deb11u1 pn libjson-xs-perl <none> pn liblatex-driver-perl <none> pn libmath-bigint-gmp-perl <none> pn libtemplate-plugin-latex-perl <none> pn libtex-encode-perl <none> pn texlive-latex-recommended <none> Versions of packages ledgersmb suggests: ii exim4-daemon-light [mail-transport-agent] 4.94.2-7 pn latex-cjk-all <none> pn libimage-size-perl <none> pn libopenoffice-oodoc-perl <none> pn libx12-parser-perl <none> pn lpr <none> ii postgresql 13+225 pn texlive-xetex <none> -- debconf information: * ledgersmb/lsmb_proxy: None * ledgersmb/admin_login: lsmb_dbadmin

2 1

Bug#1027472: ledgersmb: upstram says 1.6 is unsupported and insecure. Newer upstream version 1.10 available
by Tobias Frost 18 Jan '26

18 Jan '26

Source: ledgersmb Severity: normal Tags: security Please consider updating ledgersmb. Filing as RC critical due to secrutiy issues in the old version. Upstream says: "The current stable release line is 1.10. For more information about older versions, see the FAQ item about supported releases. Versions 1.6 and older should no longer be used due to known security issues that cannot be resolved in that code base." [1] Upstream had declared 1.6 end of life 2021-06-10 [2] [1] https://ledgersmb.org/content/download [2] https://ledgersmb.org/faq/which-versions-do-you-support -- tobi

3 2

LedgerSMB 1.12.14 released
by Erik Huelsmann 29 Sep '25

29 Sep '25

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains fixes two regressions since 1.12.13: Changelog for 1.12.14 * Fix WHERE statement in schema upgrade script (#9061) * Fix typo in table name in post-upgrade script (#9060) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.12.14/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.12.14 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.12.14 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.12.14 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.12.14 These are the sha256 checksums of the uploaded files: 02dd5033b84dbb803d4c886145bf2e8c67518da082d7405de4a0448fb85caf64 ledgersmb-1.12.14.tar.gz a1600c6bf2a71ca1d931f9c232229da7396691faa02b5334949612bcacfae690 ledgersmb-1.12.14.tar.gz.asc

1 0

LedgerSMB 1.13.0-rc1 released
by Erik Huelsmann 14 Sep '25

14 Sep '25

The LedgerSMB development team is happy to announce the first release candidate for version 1.13 of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.13.0 Added functionalities * Concurrent logins into multiple companies on a single browser (#8496) * Ability to remove unused customers, credit accounts (#8616) * Search box added to the menu (#8831) * Tracking of user logins and logout for audit purposes (#8784) * Localization of names in the country selection drop-down (#8749) * Improved on-boarding experience with new installer supporting more platforms to handle dependencies than previous methods; see https://get.ledgersmb.org * Technical support for arbitrary attributes on parts and others (#8996) * Scheduled actions from upgrades; e.g. removal of migration artifacts (#8979) * GL Report improvements: * Opening and closing balances split by FX in GL report (#9023) * Opening and closing balances in GL report FX Debit/credit columns (#9018) Changed functionalities * Concurrent logins with different users on one browser throw an error (#8496) * Confusing menu name 'Add Contact' changed to 'Add entity' (#8003) * Split toplevel Reports menu over General Journal and Goods & Services (#8850) * Menu reloaded from file (./locale/menu.xml) on each upgrade (#8876) Removed functionalities Bugs fixed * Better referential integrity with more relational constraints (#8661, #8794) Cleanup & architecture improvements * Simplified balance sheet and income statement report templates (#9024, #9025) * Added several ADRs (architecture decision records) describing project direction * Encapsulation of Dojo widgets in custom (web) elements (#8874) * Deprecated 'ledgersmb.conf' configuration in favor of 'ledgersmb.yaml' (#8570) * Loading of main section more predictable through state machine use (#8530) * Removed deps in favor of (experimental) built-in functionality (#8571, #8572) * Allow workflows to determine buttons on read-only screens (#8583) * Removal of custom SMTP handling class; replaced with Email::Sender (#8576) * Dropped unnecessary table inheritance (#8046) * Replacement of various Dojo layout components with Vue equivalents (#8811) * Dead code removal (#8579, #8591, #8613, #8826, #8874) * Move end-to-end UI tests from Selenium Hub v3 to v4 (#8829) Updated dependencies * Feature::Compat::Try (removed) * IO::Scalar (removed) * Workflow (2.06, from <2.0) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.13.0-rc1/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.13.0-rc1 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.13.0-rc1 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.13.0-rc1 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.13.0-rc1 These are the sha256 checksums of the uploaded files: 0e0529a2ff7900847b69052eeb4774eac27740ea92bb87e3afb75506dfab7000 ledgersmb-1.13.0-rc1.tar.gz a6a5c38bb907afb9c31fa0600f87bdc76bf864f8a94fbedb00069c74e66deec4 ledgersmb-1.13.0-rc1.tar.gz.asc

1 0

LedgerSMB 1.12.13 released
by Erik Huelsmann 06 Sep '25

06 Sep '25

The LedgerSMB development team is happy to announce yet another new version of its open source ERP and accounting application. This release contains the following fixes and improvements: Changelog for 1.12.13 * Fix reconciliations missing workflow context (#9004) * Fix starting balance in GL report filtered by account (#9020) * Add taxtotal for invoice printing (#9006) For installation instructions and system requirements, see https://github.com/ledgersmb/LedgerSMB/blob/1.12.13/README.md The release can be downloaded from our download site at https://download.ledgersmb.org/f/Releases/1.12.13 The release can be downloaded from GitHub at https://github.com/ledgersmb/LedgerSMB/releases/tag/1.12.13 Or pulled from the GitHub Container Registry $ docker pull ghcr.io/ledgersmb/ledgersmb:1.12.13 Or pulled from Docker Hub using the command $ docker pull ledgersmb/ledgersmb:1.12.13 These are the sha256 checksums of the uploaded files: 5d634172e55799efcd316e0caa818ef9aa10d8ff4b056a46a4b5df62287c3dc9 ledgersmb-1.12.13.tar.gz fc75a2c34d04231385ee8ac287026e44a86bdf70e3c1beb096aebbea88c48395 ledgersmb-1.12.13.tar.gz.asc

1 0