Skip to content
Snippets Groups Projects
Commit 11768733 authored by Justin Clift's avatar Justin Clift Committed by Brad King
Browse files

NSIS: Quote uninstaller path when executing it in a shell


Protect our `$0` reference in the shell as `"$0"`.  Otherwise it works
with a space in the path only due to an insecure Windows feature.

Prior to this fix, any installer using the option added by commit
v2.8.9~234^2 (Added CPACK_NSIS_ENABLE_UNINSTALL_BEFORE_INSTALL,
2011-06-11) exposes a local privilege escalation vulnerability.

Reported-by: default avatarAmir Szekely <kichik@gmail.com>
Reported-by: Ug_0 Security
parent e31084e6
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment