| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Ignore null deferred postings | Michael Budde | 2019-01-23 | 1 | -0/+3 |
| | | | | | | | | | | | | | | | | | | | All-null transactions (i.e. a transaction where all postings have a null amount) are discarded during parsing and the `xact` object is free'd. But if the transaction contains a deferred posting this results in a use-after-free vulnerability because a reference to the deferred posting is stored in the account object which is later read when deferred postings are applied after parsing is finished. Ignore null deferred postings to prevent this – they should not have any effect any way. Thanks to Cory Duplantis for reporting this issue and providing an initial analysis. Ref TALOS-2017-0304, CVE-2017-2808 Fixes #1723 | ||||
| * | Fix parsing issue involving effective dates | Martin Michlmayr | 2019-01-15 | 1 | -0/+3 |
| | | | | | | | | | | | | | | | | | | Cory Duplantis reported that "A specially crafted journal file can cause [an] integer underflow resulting in code execution". Cory provided this test case: Expenses:Food:Groceries $ 37.50 ; ] [=2004/01/01] Note the ] that comes before [ after the ;. This issue was reported and described in great detail by Cory Duplantis of Cisco Talos. This issue is known as TALOS-2017-0303 and has been assigned CVE-2017-2807. Cory's description can be found at https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303 Fixes #1722 | ||||
| * | Update NEWS for 3.1.2 | Martin Michlmayr | 2019-01-12 | 1 | -9/+42 |
| | | |||||
| * | Add release dates to doc/NEWS | Martin Michlmayr | 2019-01-12 | 1 | -3/+3 |
| | | |||||
| * | Remove trailing whitespace | Martin Michlmayr | 2019-01-09 | 1 | -7/+7 |
| | | |||||
| * | Update doc/NEWS for 3.1.2 | Martin Michlmayr | 2016-11-12 | 1 | -5/+9 |
| | | |||||
| * | Update doc/NEWS for 3.1.2 | Martin Michlmayr | 2016-07-29 | 1 | -1/+20 |
| | | |||||
| * | Increase maximum length for regex | Martin Michlmayr | 2016-02-15 | 1 | -0/+4 |
| | | | | | Fixes bug #981 | ||||
| * | [doc] Correct boost versions | Alexis Hildebrandt | 2016-01-11 | 1 | -1/+1 |
| | | | | | | | whose build issues are fixed with the ledger 3.1.1 release. [ci skip] | ||||
| * | Bump version number to 3.1.1 | Alexis Hildebrandt | 2015-09-15 | 1 | -2/+8 |
| | | |||||
| * | Update NEWS | Martin Michlmayr | 2015-07-28 | 1 | -0/+2 |
| | | |||||
| * | Document some changes in NEWS | Martin Michlmayr | 2015-07-28 | 1 | -0/+22 |
| | | |||||
| * | Small doc typo fixes | Jostein Berntsen | 2015-01-09 | 1 | -3/+3 |
| | | |||||
| * | Update doc/NEWS for ledger 3.1 | Martin Michlmayr | 2014-10-05 | 1 | -2/+27 |
| | | |||||
| * | Add another change to NEWS | Martin Michlmayr | 2014-05-12 | 1 | -0/+2 |
| | | |||||
| * | Update NEWS for 3.x | Martin Michlmayr | 2014-05-12 | 1 | -0/+16 |
| | | |||||
| * | Added NEWS entries for 2.6.2 and 2.6.3 | John Wiegley | 2010-06-19 | 1 | -0/+17 |
| | | |||||
| * | Untabified all source files | John Wiegley | 2010-06-11 | 1 | -14/+14 |
| | | |||||
| * | Updated NEWS file that there will be less news | John Wiegley | 2010-05-22 | 1 | -29/+8 |
| | | |||||
| * | Some reformatting of the NEWS file | John Wiegley | 2009-02-19 | 1 | -16/+20 |
| | | |||||
| * | Inverted the default display mode for balance reports. Use -n to collapse | John Wiegley | 2009-02-08 | 1 | -7/+18 |
| | | | | | them, as this fits better with what -n does for register reports. | ||||
| * | Removed --reconcile and --reconcile-date. | John Wiegley | 2009-02-07 | 1 | -0/+2 |
| | | |||||
| * | Removed the nearly unknown --descend and --descend-if options. | John Wiegley | 2009-02-06 | 1 | -3/+14 |
| | | |||||
| * | Added a note about --anon to the NEWS file. | John Wiegley | 2009-01-20 | 1 | -0/+6 |
| | | |||||
| * | Moved several documentation files into the 'doc' directory. | John Wiegley | 2008-08-07 | 1 | -0/+842 |
 |
index : fork-ledger.git | |
| summaryrefslogtreecommitdiff |