Improper input validation in Barebones Bbedit
CVE-2013-3667
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.018 (76.4th percentile) — read the EPSS interpretation.
Affected products
- Barebones Bbedit — versions 10.0, 10.0.1, 10.1
- Barebones Textwrangler — versions 2.3, 3.0, 3.1
- Barebones Yojimbo — versions 1.4, 1.4.1, 1.4.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)