medium5.5
CVE-2015-9267
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files.
Impact
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nullsoft | Nullsoft Scriptable Install System | before 2.49 |
| Debian | Debian Linux | Version 8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://jvn.jp/en/jp/JVN68418039/index.html
- https://lists.debian.org/debian-lts-announce/2018/11/msg00041.html
- https://sourceforge.net/p/nsis/bugs/1125/
- http://jvn.jp/en/jp/JVN68418039/index.html
- https://lists.debian.org/debian-lts-announce/2018/11/msg00041.html
- https://sourceforge.net/p/nsis/bugs/1125/