Improper input validation in Barebones Bbedit
CVE-2013-3667
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.4 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.018 (77.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 77.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Barebones Bbedit — versions 10.0, 10.0.1, 10.1
- Barebones Textwrangler — versions 2.3, 3.0, 3.1
- Barebones Yojimbo — versions 1.4, 1.4.1, 1.4.2
Weakness classification (CWE)
References
- www.barebones.com/support/yojimbo/arch_yojimbo40.html (Vendor Advisory)
- www.barebones.com/support/bbedit/arch_bbedit1055.html (Vendor Advisory)
- groups.google.com/forum/
- www.barebones.com/support/textwrangler/notes_tw453.html (Vendor Advisory)