January 2026 - devel - lists.freelock.com

Bug#831688: marked as done (LedgerSMB does not have Japanese as an available language.)
by Debian Bug Tracking System 18 Jan '26

18 Jan '26

Your message dated Sun, 18 Jan 2026 12:59:51 +0000 with message-id <E1vhSNj-00000007kHv-2hvP(a)fasolo.debian.org> and subject line Bug#1122176: Removed package(s) from unstable has caused the Debian Bug report #831688, regarding LedgerSMB does not have Japanese as an available language. to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner(a)bugs.debian.org immediately.) -- 831688: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831688 Debian Bug Tracking System Contact owner(a)bugs.debian.org with problems

1 0

Bug#1112641: ledgersmb: FTBFS with Perl 5.42: Possible precedence problem between ! and pattern match (m//)
by Niko Tyni 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.2 Severity: important Tags: ftbfs forky sid User: debian-perl(a)lists.debian.org Usertags: perl-5.42-transition This package fails to build with Perl 5.42 (currently in experimental.) https://perl.debian.net/rebuild-logs/perl-5.42-throwaway/ledgersmb_1.6.33+d… # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: marktext() called with non string first argument; resetting scan (consider using maketext('') directly!' # at t/07.1-extract-perl.t line 102. # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: Direct variable interpolation not supported; use bracketed ([_1]) syntax for '$form->{title}'!' # at t/07.1-extract-perl.t line 102. # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: Direct variable interpolation not supported; use bracketed ([_1]) syntax for '$b->{c}'!' # at t/07.1-extract-perl.t line 102. # Failed test 'Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 124. # Possible precedence problem between ! and pattern match (m//) at utils/devel/extract-perl line 136. # /tmp/extract-tests.pl:1: Direct variable interpolation not supported; use bracketed ([_1]) syntax for '$b->{c}'!' # at t/07.1-extract-perl.t line 102. # Looks like you failed 4 tests of 21. t/07.1-extract-perl.t ........... Dubious, test returned 4 (wstat 1024, 0x400) Failed 4/21 subtests [...] Test Summary Report ------------------- t/07.1-extract-perl.t (Wstat: 1024 (exited 4) Tests: 21 Failed: 4) Failed tests: 2-3, 13, 16 Non-zero exit status: 4 Files=20, Tests=1802, 17 wallclock secs ( 0.31 usr 0.08 sys + 13.40 cusr 2.23 csys = 16.02 CPU) Result: FAIL make[1]: *** [Makefile:474: test] Error 1 If you want to test changes against Perl 5.42 in experimental and run into uninstallability problems, there is a test repository of rebuilt Debian sid packages for amd64 available at <https://perl.debian.net/>. Thanks for your work on Debian, -- Niko Tyni ntyni(a)debian.org

3 2

Bug#1082804: ledgersmb: FTBFS (test failure) if building as root
by наб 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.2 Severity: serious Tags: ftbfs Justification: fails to build from source Dear Maintainer, During a ratt run for src:ossp-uuid I got 2024/09/26 17:23:23 Building package 71 of 123: ledgersmb 2024/09/26 17:26:55 building ledgersmb failed: exit status 2 Full log attached, but the interesting bit is make[1]: Leaving directory '/<<PKGBUILDDIR>>' dh_auto_test make -j24 test make[1]: Entering directory '/<<PKGBUILDDIR>>' make[1]: git: No such file or directory /bin/sh: 1: lsb_release: not found prove t/ # Failed test 'use LedgerSMB::PSGI;' # at t/01-load.t line 231. # Tried to use 'LedgerSMB::PSGI'. # Error: Running a Web Service as root is a security problem. # If you are starting LedgerSMB as a system service, # please make sure that you drop privileges as per README.md # and the example files in conf/. # The method of passing a --user argument to starman cannot # be used as starman drops privileges too late, starting us as root. at /<<PKGBUILDDIR>>/lib/LedgerSMB/PSGI.pm line 42. # Compilation failed in require at t/01-load.t line 231. # BEGIN failed--compilation aborted at t/01-load.t line 231. # Looks like you failed 1 test of 209. t/01-load.t ..................... Dubious, test returned 1 (wstat 256, 0x100) Failed 1/209 subtests (less 5 skipped subtests: 203 okay) Name "Config::IniFiles::ledgersmb.conf" used only once: possible typo at /usr/lib/x86_64-linux-gnu/perl-base/Symbol.pm line 60. t/02-number-handling.t .......... ok Per my reading of the policy, each d/rules target may be run as root? Best, -- System Information: Debian Release: 12.4 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.1.0-12-amd64 (SMP w/24 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled

3 4

Bug#1104577: ledgersmb: preinst fails, calls adduser without Pre-Depend-ing on it
by Chris Hofstaedtler 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.33+ds-2.2 Severity: serious User: reproducible-builds(a)lists.alioth.debian.org Usertag: toolchain Your package has a preinst maintainer script, calling adduser. At the same time, your package Depends: adduser, but does not Pre-Depends: adduser. Installing your package fails when adduser is not yet configured. Reproducer: $ mmdebstrap --variant=essential --include=ledgersmb unstable /dev/null ... Selecting previously unselected package ledgersmb. Preparing to unpack .../211-ledgersmb_1.6.33+ds-2.2_all.deb ... warn: `/etc/adduser.conf' does not exist. Using defaults. Insecure $ENV{PATH} while running with -T switch at /usr/share/perl5/Debian/AdduserLogging.pm line 161. dpkg: error processing archive /tmp/apt-dpkg-install-Z6hj5d/211-ledgersmb_1.6.33+ds-2.2_all.deb (--unpack): new ledgersmb package pre-installation script subprocess returned error exit status 25 Errors were encountered while processing: /tmp/apt-dpkg-install-Z6hj5d/211-ledgersmb_1.6.33+ds-2.2_all.deb E: Sub-process env returned an error code (1) You may consider replacing adduser with a sysusers fragment, see https://manpages.debian.org/unstable/debhelper/dh_installsysusers.1.en.html Otherwise, please Pre-Depend on adduser. Best, Chris

2 1

Bug#1062845: ledgersmb: CVE-2024-23831
by Salvatore Bonaccorso 18 Jan '26

18 Jan '26

Source: ledgersmb Version: 1.6.33+ds-2.1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil(a)debian.org, Debian Security Team <team(a)security.debian.org> Control: found -1 1.6.9+ds-2+deb11u3 Hi, The following vulnerability was published for ledgersmb. CVE-2024-23831[0]: | LedgerSMB is a free web-based double-entry accounting system. When a | LedgerSMB database administrator has an active session in /setup.pl, | an attacker can trick the admin into clicking on a link which | automatically submits a request to setup.pl without the admin's | consent. This request can be used to create a new user account with | full application (/login.pl) privileges, leading to privilege | escalation. The vulnerability is patched in versions 1.10.30 and | 1.11.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-23831 https://www.cve.org/CVERecord?id=CVE-2024-23831 [1] https://github.com/ledgersmb/LedgerSMB/security/advisories/GHSA-98ff-f638-q… [2] https://github.com/ledgersmb/LedgerSMB/commit/8c2ae5be68a782d62cb9c0e17c012… Regards, Salvatore

2 2

Bug#1029045: ledgersmb: login page Perl error in default config
by JB 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.9+ds-2+deb11u3 Severity: important X-Debbugs-Cc: j-dbug.666.114.1101(a)x.firehead.org Dear Maintainer, I installed LedgerSMB with defaults on Debian-11 with systemd. It starts fine with Starman, but when I go to http://localhost:5762/login.pl it shows only this message: ----- Error! Can't locate object method "new" via package "Template" at /usr/share/ledgersmb/bin/../lib/LedgerSMB/Template.pm line 599. dbversion: , company: 1.6.9 ----- Thus leaving the package in an unusable state. -- System Information: Debian Release: 11.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-20-amd64 (SMP w/2 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages ledgersmb depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.77 ii dpkg 1.20.12 ii libcarp-always-perl 0.16-1 ii libcgi-emulate-psgi-perl 0.23-1 ii libcgi-simple-perl 1.115-2 ii libclass-c3-xs-perl 0.15-1+b1 ii libconfig-inifiles-perl 3.000003-1 ii libdata-uuid-perl 1.226-1+b1 ii libdatetime-format-strptime-perl 1.7800-1 ii libdatetime-perl 2:1.54-1 ii libdbd-pg-perl 3.14.2-1+b1 ii libdbi-perl 1.643-3+b1 ii libhtml-escape-perl 1.10-1+b3 ii libhttp-exception-perl 0.04007-1 ii libio-stringy-perl 2.111-3 ii libjs-dojo-dijit 1.15.4+dfsg1-1+deb11u1 ii libjson-perl 4.03000-1 ii liblocale-codes-perl 3.66-1 ii liblocale-maketext-lexicon-perl 1.00-1.1 ii liblog-log4perl-perl 1.54-1 ii libmime-lite-perl 3.031-1 ii libmime-types-perl 2.18-1 ii libmoose-perl 2.2014-2 ii libmoosex-nonmoose-perl 0.26-1.1 ii libnamespace-autoclean-perl 0.29-1 ii libnumber-format-perl 1.75-1.1 ii libpgobject-perl 2.2.0-1 ii libpgobject-simple-perl 3.000002-1.1 ii libpgobject-simple-role-perl 2.000002-1.1 ii libpgobject-type-bigfloat-perl 2.001-1 ii libpgobject-type-bytestring-perl 1.2.3-1 ii libpgobject-type-datetime-perl 2.000002-1 ii libpgobject-util-dbadmin-perl 1.4.0-1 ii libpgobject-util-dbmethod-perl 1.00.003-1 ii libplack-builder-conditionals-perl 0.05-1.1 ii libplack-middleware-reverseproxy-perl 0.16-1 ii libplack-perl 1.0048-1 ii libplack-request-withencoding-perl 0.14-1 ii libtemplate-perl 2.27-1+b3 ii libtext-markdown-perl 1.000031-3 ii libtry-tiny-perl 0.30-1 ii libversion-compare-perl 0.14-1.1 ii libxml-simple-perl 2.25-1 ii perl 5.32.1-4+deb11u2 ii postgresql-client 13+225 ii postgresql-client-13 [postgresql-client] 13.9-0+deb11u1 ii postgresql-contrib 13+225 ii starman 0.4015-1 ii ucf 3.0043 Versions of packages ledgersmb recommends: pn libjson-xs-perl <none> pn liblatex-driver-perl <none> pn libmath-bigint-gmp-perl <none> pn libtemplate-plugin-latex-perl <none> pn libtex-encode-perl <none> ii lighttpd 1.4.59-1+deb11u2 pn texlive-latex-recommended <none> Versions of packages ledgersmb suggests: pn default-mta | mail-transport-agent <none> pn latex-cjk-all <none> pn libimage-size-perl <none> pn libopenoffice-oodoc-perl <none> pn libx12-parser-perl <none> pn lpr <none> ii postgresql 13+225 pn texlive-xetex <none> -- debconf information: * ledgersmb/lsmb_proxy: Lighttpd * ledgersmb/admin_login: lsmb_dbadmin

2 1

Bug#1028924: ledgersmb: Init script calls start-stop-daemon incorrectly, fails to start
by JB 18 Jan '26

18 Jan '26

Package: ledgersmb Version: 1.6.9+ds-2+deb11u3 Severity: important X-Debbugs-Cc: j-dbug.666.114.1101(a)x.firehead.org Dear Maintainer, I installed LedgerSMB with defaults on Debian-11 with sysvinit (instead of systemd). When I try to start the daemon, it produces the following output: # /etc/init.d/ledgersmb start $Starting ledgersmb: start-stop-daemon: unrecognized option '--interval=5' Try 'start-stop-daemon --help' for more information. # I am not an expert on start-stop-daemon, but looking at the init script, it seems start-stop-daemon is invoked with /usr/bin/start_server as the intended program to run, which then has further arguments for that to start /usr/bin/starman. However the start-stop-daemon invocation lacks a "--start" argument prior to the /usr/bin/start_server, and the "--start" seems to be the norm among other uses of start-stop-daemon in the system's /etc/init.d/* files. So maybe the init script is for some completely different version of start-stop-daemon, or the arguments are really for a different program, or something. I'm not quite sure. -- System Information: Debian Release: 11.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'oldstable-updates'), (500, 'stable'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 5.10.0-20-amd64 (SMP w/2 CPU threads) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: sysvinit (via /sbin/init) LSM: AppArmor: enabled Versions of packages ledgersmb depends on: ii adduser 3.118 ii debconf [debconf-2.0] 1.5.77 ii dpkg 1.20.12 ii libcarp-always-perl 0.16-1 ii libcgi-emulate-psgi-perl 0.23-1 ii libcgi-simple-perl 1.115-2 ii libclass-c3-xs-perl 0.15-1+b1 ii libconfig-inifiles-perl 3.000003-1 ii libdata-uuid-perl 1.226-1+b1 ii libdatetime-format-strptime-perl 1.7800-1 ii libdatetime-perl 2:1.54-1 ii libdbd-pg-perl 3.14.2-1+b1 ii libdbi-perl 1.643-3+b1 ii libhtml-escape-perl 1.10-1+b3 ii libhttp-exception-perl 0.04007-1 ii libio-stringy-perl 2.111-3 ii libjs-dojo-dijit 1.15.4+dfsg1-1+deb11u1 ii libjson-perl 4.03000-1 ii liblocale-codes-perl 3.66-1 ii liblocale-maketext-lexicon-perl 1.00-1.1 ii liblog-log4perl-perl 1.54-1 ii libmime-lite-perl 3.031-1 ii libmime-types-perl 2.18-1 ii libmoose-perl 2.2014-2 ii libmoosex-nonmoose-perl 0.26-1.1 ii libnamespace-autoclean-perl 0.29-1 ii libnumber-format-perl 1.75-1.1 ii libpgobject-perl 2.2.0-1 ii libpgobject-simple-perl 3.000002-1.1 ii libpgobject-simple-role-perl 2.000002-1.1 ii libpgobject-type-bigfloat-perl 2.001-1 ii libpgobject-type-bytestring-perl 1.2.3-1 ii libpgobject-type-datetime-perl 2.000002-1 ii libpgobject-util-dbadmin-perl 1.4.0-1 ii libpgobject-util-dbmethod-perl 1.00.003-1 ii libplack-builder-conditionals-perl 0.05-1.1 ii libplack-middleware-reverseproxy-perl 0.16-1 ii libplack-perl 1.0048-1 ii libplack-request-withencoding-perl 0.14-1 ii libtemplate-perl 2.27-1+b3 ii libtext-markdown-perl 1.000031-3 ii libtry-tiny-perl 0.30-1 ii libversion-compare-perl 0.14-1.1 ii libxml-simple-perl 2.25-1 ii perl 5.32.1-4+deb11u2 ii postgresql-client-13 [postgresql-client] 13.9-0+deb11u1 ii postgresql-contrib 13+225 ii starman 0.4015-1 ii ucf 3.0043 Versions of packages ledgersmb recommends: ii apache2 2.4.54-1~deb11u1 pn libjson-xs-perl <none> pn liblatex-driver-perl <none> pn libmath-bigint-gmp-perl <none> pn libtemplate-plugin-latex-perl <none> pn libtex-encode-perl <none> pn texlive-latex-recommended <none> Versions of packages ledgersmb suggests: ii exim4-daemon-light [mail-transport-agent] 4.94.2-7 pn latex-cjk-all <none> pn libimage-size-perl <none> pn libopenoffice-oodoc-perl <none> pn libx12-parser-perl <none> pn lpr <none> ii postgresql 13+225 pn texlive-xetex <none> -- debconf information: * ledgersmb/lsmb_proxy: None * ledgersmb/admin_login: lsmb_dbadmin

2 1

Bug#1027472: ledgersmb: upstram says 1.6 is unsupported and insecure. Newer upstream version 1.10 available
by Tobias Frost 18 Jan '26

18 Jan '26

Source: ledgersmb Severity: normal Tags: security Please consider updating ledgersmb. Filing as RC critical due to secrutiy issues in the old version. Upstream says: "The current stable release line is 1.10. For more information about older versions, see the FAQ item about supported releases. Versions 1.6 and older should no longer be used due to known security issues that cannot be resolved in that code base." [1] Upstream had declared 1.6 end of life 2021-06-10 [2] [1] https://ledgersmb.org/content/download [2] https://ledgersmb.org/faq/which-versions-do-you-support -- tobi

3 2

Bug#1122176: Removed package(s) from unstable
by Debian FTP Masters 18 Jan '26

18 Jan '26

Version: 1.6.33+ds-2.2+rm Dear submitter, as the package ledgersmb has just been removed from the Debian archive unstable we hereby close the associated bug reports. We are sorry that we couldn't deal with your issue properly. For details on the removal, please see https://bugs.debian.org/1122176 The version of this package that was in Debian prior to this removal can still be found using https://snapshot.debian.org/. Please note that the changes have been done on the master archive and will not propagate to any mirrors until the next dinstall run at the earliest. This message was generated automatically; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster(a)ftp-master.debian.org. Debian distribution maintenance software pp. Joerg Jaspert (the ftpmaster behind the curtain)

1 0

Bug#1122176: Removed package(s) from unstable
by Debian FTP Masters 18 Jan '26

18 Jan '26

We believe that the bug you reported is now fixed; the following package(s) have been removed from unstable: ledgersmb | 1.6.33+ds-2.2 | source, all ------------------- Reason ------------------- RoQA; rc-buggy ---------------------------------------------- Note that the package(s) have simply been removed from the tag database and may (or may not) still be in the pool; this is not a bug. The package(s) will be physically removed automatically when no suite references them (and in the case of source, when no binary references it). Please also remember that the changes have been done on the master archive and will not propagate to any mirrors until the next dinstall run at the earliest. Packages are usually not removed from testing by hand. Testing tracks unstable and will automatically remove packages which were removed from unstable when removing them from testing causes no dependency problems. The release team can force a removal from testing if it is really needed, please contact them if this should be the case. We try to close bugs which have been reported against this package automatically. But please check all old bugs, if they were closed correctly or should have been re-assigned to another package. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1122176(a)bugs.debian.org. The full log for this bug can be viewed at https://bugs.debian.org/1122176 This message was generated automatically; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster(a)ftp-master.debian.org. Debian distribution maintenance software pp. Joerg Jaspert (the ftpmaster behind the curtain)

1 0