Debian Package Tracker

general

source: ledger (main)
version: 3.1.2~pre1+g3a00e1c+dfsg1-5
maintainer: David Bremner [DMD]
uploaders: Matt Palmer [DMD]
arch: all any
std-ver: 3.9.6
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.6.2-3.1
o-o-bpo: 3.0.0+dfsg3-1~bpo70+1
oldstable: 3.1+dfsg1-2
stable: 3.1.2~pre1+g3a00e1c+dfsg1-2
testing: 3.1.2~pre1+g3a00e1c+dfsg1-5
unstable: 3.1.2~pre1+g3a00e1c+dfsg1-5

versioned links

2.6.2-3.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.0+dfsg3-1~bpo70+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1+dfsg1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2~pre1+g3a00e1c+dfsg1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2~pre1+g3a00e1c+dfsg1-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

elpa-ledger
ledger
ledger-dbg
ledger-el
python-ledger

action needed

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: repository 'https://anonscm.debian.org/git/collab-maint/ledger.git/' not found

Created: 2018-05-31 Last update: 2018-12-16 18:34

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 3.9.6).

Created: 2016-02-15 Last update: 2018-08-26 08:16

4 security issues in buster high

There are 4 open security issues in buster.

4 important issues:

CVE-2017-2807: An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.
CVE-2017-2808: An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.
CVE-2017-12482: The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVE-2017-12481: The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-05 Last update: 2018-06-02 08:03

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2017-2807: An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.
CVE-2017-2808: An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.
CVE-2017-12482: The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVE-2017-12481: The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-05 Last update: 2018-06-02 08:03

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

python-ledger could be marked Multi-Arch: same

Created: 2016-09-16 Last update: 2018-12-17 12:44

lintian reports 10 warnings normal

Lintian reports 10 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-03-07 Last update: 2018-09-10 05:05

The URL(s) for this package had some recent persistent issues low

DUCK reports some issues concerning upstream URLs defined for this package.

Created: 2018-09-07 Last update: 2018-12-17 15:28

4 ignored security issues in stretch low

There are 4 open security issues in stretch.

4 issues skipped by the security teams:

CVE-2017-2807: An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.
CVE-2017-2808: An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.
CVE-2017-12482: The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVE-2017-12481: The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-05 Last update: 2018-06-02 08:03

4 ignored security issues in jessie low

There are 4 open security issues in jessie.

4 issues skipped by the security teams:

CVE-2017-2807: An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.
CVE-2017-2808: An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.
CVE-2017-12482: The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
CVE-2017-12481: The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.

Please fix them.

Created: 2017-08-05 Last update: 2018-06-02 08:03

news

[rss feed]

[2017-08-13] ledger 3.1.2~pre1+g3a00e1c+dfsg1-5 MIGRATED to testing (Debian testing watch)
[2017-08-07] Accepted ledger 3.1.2~pre1+g3a00e1c+dfsg1-5 (source) into unstable (David Bremner)
[2017-08-06] Accepted ledger 3.1.2~pre1+g3a00e1c+dfsg1-4 (source) into unstable (David Bremner)
[2016-10-12] ledger 3.1.2~pre1+g3a00e1c+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2016-10-06] Accepted ledger 3.1.2~pre1+g3a00e1c+dfsg1-2 (source all amd64) into unstable, unstable (David Bremner)
[2016-09-19] ledger 3.1.2~pre1+g3a00e1c+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2016-09-13] Accepted ledger 3.1.2~pre1+g3a00e1c+dfsg1-1 (source) into unstable (David Bremner)
[2016-02-21] ledger 3.1.1+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2016-02-15] Accepted ledger 3.1.1+dfsg1-1 (source) into unstable (David Bremner)
[2015-12-04] ledger 3.1+dfsg1-7 MIGRATED to testing (Debian testing watch)
[2015-11-28] Accepted ledger 3.1+dfsg1-7 (source) into unstable (David Bremner)
[2015-09-06] ledger 3.1+dfsg1-6 MIGRATED to testing (Britney)
[2015-08-31] Accepted ledger 3.1+dfsg1-6 (all source) into unstable, unstable (David Bremner)
[2015-08-12] Accepted ledger 3.1+dfsg1-5 (all source) into unstable (David Bremner)
[2015-06-09] Accepted ledger 3.1+dfsg1-4 (source amd64 all) into experimental, experimental (David Bremner)
[2014-12-09] ledger 3.1+dfsg1-2 MIGRATED to testing (Britney)
[2014-12-03] Accepted ledger 3.1+dfsg1-2 (source amd64 all) into unstable (David Bremner)
[2014-10-24] ledger 3.1+dfsg1-1 MIGRATED to testing (Britney)
[2014-10-13] Accepted ledger 3.1+dfsg1-1 (source amd64 all) into unstable (David Bremner)
[2014-09-04] ledger 3.0.0+dfsg4-2 MIGRATED to testing (Britney)
[2014-09-01] Accepted ledger 3.0.0+dfsg4-2 (source amd64 all) into unstable (David Bremner)
[2014-08-29] Accepted ledger 3.0.0+dfsg4-1 (source amd64 all) into unstable (David Bremner)
[2014-04-19] ledger 3.0.0+dfsg3-1 MIGRATED to testing (Debian testing watch)
[2014-04-13] Accepted ledger 3.0.0+dfsg3-1 (source amd64 all) (David Bremner)
[2014-03-13] Accepted ledger 3.0.0+dfsg1-1 (source amd64 all) (David Bremner)
[2014-03-10] Accepted ledger 3.0.0~20140226+bedae81+dfsg1-2 (source amd64 all) (David Bremner)
[2014-03-03] Accepted ledger 3.0.0~20140226+bedae81+dfsg1-1 (source amd64) (David Bremner)
[2013-03-16] Accepted ledger 3.0.0~20130313+b608ed2-1 (source amd64) (David Bremner)
[2013-03-06] Accepted ledger 3.0.0~20130302+4810da9-1 (source amd64) (David Bremner)
[2012-04-21] Accepted ledger 3.0.0~20120421+7cc550f-1 (source amd64) (Matt Palmer) (signed by: Matthew Palmer)

bugs [bug history graph]

all: 14
RC: 0
I&N: 9
M&W: 4
F&P: 1
patch: 0

links

homepage
lintian (0, 10)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.1.2~pre1+g3a00e1c+dfsg1-5build7