Debian alert DSA-4962-1 (ledgersmb)

From:
             
 
Moritz Muehlenhoff <jmm@debian.org>
To:
             
 
debian-security-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DSA 4962-1] ledgersmb security update
Date:
             
 
Mon, 23 Aug 2021 19:23:23 +0000
Message-ID:
             
 
<20210823192323.GA15242@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4962-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
August 23, 2021                       https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : ledgersmb
CVE ID         : CVE-2021-3731 CVE-2021-3693 CVE-2021-3694

Several vulnerabilities were discovered in LedgerSMB, a financial
accounting and ERP program, which could result in cross-site scripting
or clickjacking.

For the oldstable distribution (buster), this problem has been fixed
in version 1.6.9+ds-1+deb10u2.

For the stable distribution (bullseye), this problem has been fixed in
version 1.6.9+ds-2+deb11u2.

We recommend that you upgrade your ledgersmb packages.

For the detailed security status of ledgersmb please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ledgersmb

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmEj9N0ACgkQEMKTtsN8
TjYA/RAAtBkVMeus8egb1BF7IZEp8ZZM/AudI8m0lWqX/TsLyxR77yQXzPT4LEMv
lmQJ1T+Le7L4D+XmLtAmg2p5FfPAI5THZOdZSk06OnSEty4xzt+MNMgf5VkssqWX
wC9IWFrkpVk+xUJ3SKWO2ZgSnW7abV6jjT1qZqCcfKlImtLV69lOCvFfZ2fjmE5Z
vuxTRlXSZ9bKdhfEO90NJ4ALJMZVyFRBrxAc8VmRqkDV2dQADRM3U3eLQZqzEibw
UPbVczpjPo6Gj6MCSFqdtQmnHyg4U2yOcDHNQM14t4MHb889MgFHlbFrTdRR70wV
Vd4Uj+RMH15qIm9uQBJT1WMksEpzR5PV2HZXI3VTT86CDNxo89MXgAiGX8cH9LZH
wwz3Dj/KZqPvy3x5iL0UDLnijt2P7MM+68jUPZCNevcP5wgCeC0vnvgIQ8Hpmv/a
8mfdz1zsBJX/asOAs2UwZM/GMkRAaW/PPX7X9kL/Ft5UNbTmXiBZkqYc74LbkIZJ
8ZSo3RFAjsnkW1W+GOJ9fGGOmBFn3Aa/wAHUF/Sc/xQygXyEaNKDiJTih0xoFvlb
LSKMoMu0+ULmblpuagLCjrmCBrdRIYTJsSD/fsRJLwAyYk4zquP51Ir3I/1Ncvx9
4W3/qxvGy9cuOZCT3eK8NQnzqrTB//G0MBvA+9TkZn9+LgvpUqw=
=AAl/
-----END PGP SIGNATURE-----