Vulnerability Description
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nullsoft | Nullsoft Scriptable Install System | < 2.49 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://jvn.jp/en/jp/JVN68418039/index.htmlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00041.htmlMailing ListThird Party Advisory
- https://sourceforge.net/p/nsis/bugs/1125/ExploitIssue TrackingPatch
- http://jvn.jp/en/jp/JVN68418039/index.htmlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00041.htmlMailing ListThird Party Advisory
- https://sourceforge.net/p/nsis/bugs/1125/ExploitIssue TrackingPatch
FAQ
What is CVE-2015-9268?
CVE-2015-9268 is a vulnerability with a CVSS score of 7.8 (HIGH). Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the depende...
How severe is CVE-2015-9268?
CVE-2015-9268 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-9268?
Check the references section above for vendor advisories and patch information. Affected products include: Nullsoft Nullsoft Scriptable Install System, Debian Debian Linux.