Local File Overwrite Vulnerability in Nullsoft Scriptable Install System
CVE-2015-9267

5.5MEDIUM

Key Information:

Vendor

Nullsoft

Status
Nullsoft Scriptable Install System
Vendor
CVE Published:
1 October 2018

What is CVE-2015-9267?

The Nullsoft Scriptable Install System (NSIS) prior to version 2.49 is susceptible to a local file overwrite vulnerability. This issue arises due to insecure handling of temporary folder locations, enabling unprivileged local users to overwrite critical files. An attacker can replace legitimate plugins or the uninstaller with a malicious program, potentially leading to system compromise and exploitation through a Trojan horse. It is crucial for users to update their NSIS installations to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://lists.debian.org/debian-lts-announce/2018/11/msg0...
mailing-listx_refsource_MLIST
https://sourceforge.net/p/nsis/bugs/1125/
x_refsource_MISC
http://jvn.jp/en/jp/JVN68418039/index.html
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.