CVEvulnerability

CVE-2013-3667

6.4 MEDIUM Published 2013-12-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-12-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
Weaknesses
CWE-20

Description

The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.

Affected configurations

• barebones textwrangler (<= 4.5.2) • barebones textwrangler 2.3 • barebones textwrangler 3.0 • barebones textwrangler 3.1 • barebones textwrangler 3.5 • barebones textwrangler 3.5.1 • barebones textwrangler 3.5.3 • barebones textwrangler 4.0 • barebones textwrangler 4.0.1 • barebones textwrangler 4.5 • barebones textwrangler 4.5.1 • barebones bbedit (<= 10.5.4) • barebones bbedit 10.0 • barebones bbedit 10.0.1 • barebones bbedit 10.1 • barebones bbedit 10.1.1 • barebones bbedit 10.1.2 • barebones bbedit 10.5 • barebones bbedit 10.5.1 • barebones bbedit 10.5.2 • barebones bbedit 10.5.3 • barebones yojimbo (<= 3.0.4) • barebones yojimbo 1.4 • barebones yojimbo 1.4.1 • barebones yojimbo 1.4.2 • barebones yojimbo 1.5 • barebones yojimbo 1.5.1 • barebones yojimbo 1.5.2 • barebones yojimbo 2.0 • barebones yojimbo 2.1 • barebones yojimbo 2.2 • barebones yojimbo 3.0 • barebones yojimbo 3.0.1 • barebones yojimbo 3.0.2 • barebones yojimbo 3.0.3

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References