CVE-2015-9267: Medium severity nullsoft scriptable install system vulnerability
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-9267?
CVE-2015-9267 has a medium severity rating due to its potential for local privilege escalation by unprivileged users.
How do I fix CVE-2015-9267?
To fix CVE-2015-9267, upgrade to Nullsoft Scriptable Install System version 2.49 or later.
What types of attacks can exploit CVE-2015-9267?
CVE-2015-9267 can be exploited by local attackers to overwrite files with Trojan horse programs.
Which software is affected by CVE-2015-9267?
CVE-2015-9267 affects Nullsoft Scriptable Install System versions prior to 2.49 and Debian GNU/Linux 8.0.
Can CVE-2015-9267 be exploited remotely?
No, CVE-2015-9267 can only be exploited locally by unprivileged users on the affected system.