CVE-2015-9267

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN68418039/index.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00041.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/nsis/bugs/1125/Exploit, Issue Tracking, Patch, Third Party Advisory
http://jvn.jp/en/jp/JVN68418039/index.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00041.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/nsis/bugs/1125/Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Oct 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92687.8Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protectio CVE-2015-92697.5The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attacke CVE-2015-92706.1XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.CVE-2015-92719.8The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code bec CVE-2015-92729.8The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php CVE-2015-92736.1The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated w CVE-2015-92746.5HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS CVE-2015-92755.3ARC 5.21q allows directory traversal via a full pathname in an archive file.CVE-2015-92766.1SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScri CVE-2015-92779.1MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../CVE-2015-92789.8MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB a CVE-2015-92796.1MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.