Vulnerability Description
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nullsoft | Nullsoft Scriptable Install System | < 2.49 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://jvn.jp/en/jp/JVN68418039/index.htmlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00041.htmlMailing ListThird Party Advisory
- https://sourceforge.net/p/nsis/bugs/1125/ExploitIssue TrackingPatch
- http://jvn.jp/en/jp/JVN68418039/index.htmlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00041.htmlMailing ListThird Party Advisory
- https://sourceforge.net/p/nsis/bugs/1125/ExploitIssue TrackingPatch
FAQ
What is CVE-2015-9267?
CVE-2015-9267 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the...
How severe is CVE-2015-9267?
CVE-2015-9267 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-9267?
Check the references section above for vendor advisories and patch information. Affected products include: Nullsoft Nullsoft Scriptable Install System, Debian Debian Linux.