medium5.3
CVE-2023-37378
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
Impact
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nullsoft | Nullsoft Scriptable Install System | through 3.09 |
References
- NVD record
- CVE.org record
- http://sf.net/p/nsis/bugs/1296
- https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967
- https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467
- https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0
- https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/
- https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09
- https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/
- http://sf.net/p/nsis/bugs/1296
- https://github.com/kichik/nsis/commit/281e2851fe669d10e0650fc89d0e7fb74a598967
- https://github.com/kichik/nsis/commit/409b5841479c44fbf33a6ba97c1146e46f965467
- https://github.com/kichik/nsis/commit/c40cf78994e74a1a3a381a850c996b251e3277c0
- https://lists.debian.org/debian-lts-announce/2023/07/msg00005.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM/
- https://nsis.sourceforge.io/Docs/AppendixF.html#v3.09
- https://sourceforge.net/p/nsis/news/2023/07/nsis-309-released/