CVE-2013-3667
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- barebones:bbedit
- barebones:textwrangler
- barebones:yojimbo
References
- http://www.barebones.com/support/bbedit/arch_bbedit1055.html
- http://www.barebones.com/support/textwrangler/notes_tw453.html
- http://www.barebones.com/support/yojimbo/arch_yojimbo40.html
- https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ
- http://www.barebones.com/support/bbedit/arch_bbedit1055.html