CVE-2023-37378 (MEDIUM 5.3) · Watchpost

← All vulnerabilities

CVE-2023-37378

MEDIUM 5.3CVE-2023-37378 · Published 03/07/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
nullsoft scriptable install system nullsoft	`≤ 3.09`	No fix yet

Description

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

References

sf.net/p/nsis/bugs/1296 · Issue Tracking
kichik/nsis commit 281e285 · Patch
kichik/nsis commit 409b584 · Patch
kichik/nsis commit c40cf78 · Patch
lists.debian.org/debian-lts-announce/2023/07/msg00005.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A65FBUMHLZ7GBV3VDKUB5EK3A7X2UUWK
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZPAAU57IA3NP6UOUXNBUQBAYK3JB2IM
nsis.sourceforge.io/Docs/AppendixF.html · Release Notes
sourceforge.net/p/nsis/news/2023/07/nsis-309-released · Release Notes
lists.debian.org/debian-lts-announce/2024/09/msg00013.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free