CVE-2015-9267: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.

Affected products

• Debian Debian Linux: version 8.0 only
• Nullsoft Nullsoft Scriptable Install System: before 2.49 (fixed in 2.49)

Published 2018-10-01. Last modified 2026-06-17.