Vulnerabilities (CVE)

Filtered by vendor Nullsoft Subscribe
Total 76 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-37378 1 Nullsoft 1 Nullsoft Scriptable Install System 2023-12-10 N/A 5.3 MEDIUM
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
CVE-2015-9268 2 Debian, Nullsoft 2 Debian Linux, Nullsoft Scriptable Install System 2023-12-10 9.3 HIGH 7.8 HIGH
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
CVE-2015-9267 2 Debian, Nullsoft 2 Debian Linux, Nullsoft Scriptable Install System 2023-12-10 3.6 LOW 5.5 MEDIUM
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
CVE-2013-4694 1 Nullsoft 1 Winamp 2023-12-10 7.5 HIGH N/A
Stack-based buffer overflow in gen_jumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a package with a long Skin directory name. NOTE: a second buffer overflow involving a long GUI Search field to ml_local.dll was also reported. However, since it is only exploitable by the user of the application, this issue would not cross privilege boundaries unless Winamp is running under a highly restricted environment such as a kiosk.
CVE-2014-3442 1 Nullsoft 1 Winamp 2023-12-10 4.3 MEDIUM N/A
Winamp 5.666 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) via a malformed .FLV file, related to f263.w5s.
CVE-2012-3890 1 Nullsoft 1 Winamp 2023-12-10 6.8 MEDIUM N/A
The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a .IT file.
CVE-2012-3889 1 Nullsoft 1 Winamp 2023-12-10 6.8 MEDIUM N/A
The in_mod plugin in Winamp before 5.63 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a .IT file.
CVE-2012-4045 1 Nullsoft 1 Winamp 2023-12-10 7.5 HIGH N/A
Multiple heap-based buffer overflows in bmp.w5s in Winamp before 5.63 build 3235 allow remote attackers to execute arbitrary code via the (1) strf chunk in BI_RGB or (2) UYVY video data in an AVI file, or (3) decompressed TechSmith Screen Capture Codec (TSCC) data in an AVI file.
CVE-2010-2586 1 Nullsoft 1 Winamp 2023-12-10 9.3 HIGH N/A
Multiple integer overflows in in_nsv.dll in the in_nsv plugin in Winamp before 5.6 allow remote attackers to execute arbitrary code via a crafted Table of Contents (TOC) in a (1) NSV stream or (2) NSV file that triggers a heap-based buffer overflow.
CVE-2009-4356 1 Nullsoft 1 Winamp 2023-12-10 9.3 HIGH N/A
Multiple integer overflows in the jpeg.w5s and png.w5s filters in Winamp before 5.57 allow remote attackers to execute arbitrary code via malformed (1) JPEG or (2) PNG data in an MP3 file.
CVE-2010-4374 1 Nullsoft 1 Winamp 2023-12-10 4.3 MEDIUM N/A
The in_mkv plugin in Winamp before 5.6 allows remote attackers to cause a denial of service (application crash) via a Matroska Video (MKV) file containing a string with a crafted length.
CVE-2011-4857 1 Nullsoft 1 Winamp 2023-12-10 10.0 HIGH N/A
Heap-based buffer overflow in the in_mod.dll plugin in Winamp before 5.623 allows remote attackers to execute arbitrary code via crafted song message data in an Impulse Tracker (IT) file. NOTE: some of these details are obtained from third party information.
CVE-2010-4371 1 Nullsoft 1 Winamp 2023-12-10 9.3 HIGH N/A
Buffer overflow in the in_mod plugin in Winamp before 5.6 allows remote attackers to have an unspecified impact via vectors related to the comment box.
CVE-2011-3834 1 Nullsoft 1 Winamp 2023-12-10 9.3 HIGH N/A
Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk, leading to a heap-based buffer overflow.
CVE-2010-3137 1 Nullsoft 1 Winamp 2023-12-10 9.3 HIGH N/A
Untrusted search path vulnerability in Nullsoft Winamp 5.581, and probably other versions, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wnaspi32.dll that is located in the same folder as a .669, .aac, .aiff, .amf, .au, .avr, .b4s, .caf or .cda file.
CVE-2010-1523 1 Nullsoft 1 Winamp 2023-12-10 9.3 HIGH N/A
Multiple heap-based buffer overflows in vp6.w5s (aka the VP6 codec) in Winamp before 5.59 Beta build 3033 might allow remote attackers to execute arbitrary code via a crafted VP6 (1) video file or (2) video stream.
CVE-2009-3997 1 Nullsoft 1 Winamp 2023-12-10 9.3 HIGH N/A
Integer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57 might allow remote attackers to execute arbitrary code via an Oktalyzer file that triggers a heap-based buffer overflow.
CVE-2010-4373 1 Nullsoft 1 Winamp 2023-12-10 4.3 MEDIUM N/A
The in_mp4 plugin in Winamp before 5.6 allows remote attackers to cause a denial of service (application crash) via crafted (1) metadata or (2) albumart in an invalid MP4 file.
CVE-2009-3995 2 Nullsoft, Raphael Assenat 2 Winamp, Libmikmod 2023-12-10 9.3 HIGH N/A
Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file. NOTE: some of these details are obtained from third party information.
CVE-2009-3996 2 Nullsoft, Raphael Assenat 2 Winamp, Libmikmod 2023-12-10 9.3 HIGH N/A
Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file.