MGASA-2015-0017

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2015-0017.html
Import Source
https://advisories.mageia.org/MGASA-2015-0017.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2015-0017
Upstream
  • CVE-2014-5032
  • CVE-2014-8360
  • CVE-2014-9258
Published
2015-01-09T16:44:12Z
Modified
2026-04-16T06:23:31.769637289Z
Summary
Updated glpi package fixes security vulnerabilities
Details

Updated glpi package fixes security vulnerabilities:

Due to a bug in GLPI before 0.84.7, a user without access to cost information can in fact see the information when selecting cost as a search criteria (CVE-2014-5032).

An issue in GLPI before 0.84.8 may allow arbitrary local files to be included by PHP through an autoload function (CVE-2014-8360).

SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter (CVE-2014-9258).

References
Credits

Affected packages

Mageia:4 / glpi

Package

Name
glpi
Purl
pkg:rpm/mageia/glpi?arch=source&distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.84.3-1.2.mga4

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2015-0017.json"