CVE-2013-3667

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-3667
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.barebones.com/support/bbedit/arch_bbedit1055.html Vendor Advisory
http://www.barebones.com/support/textwrangler/notes_tw453.html Vendor Advisory
http://www.barebones.com/support/yojimbo/arch_yojimbo40.html Vendor Advisory
https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:barebones:textwrangler:*:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:2.3:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:3.0:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:3.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:3.5:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:3.5.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:3.5.3:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:4.0:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:4.5:*:*:*:*:*:*:*
cpe:2.3:a:barebones:textwrangler:4.5.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.0:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.1.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.1.2:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.5:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.5.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.5.2:*:*:*:*:*:*:*
cpe:2.3:a:barebones:bbedit:10.5.3:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:barebones:yojimbo:*:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:1.4:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:1.5:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:2.0:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:2.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:2.2:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:3.0:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:barebones:yojimbo:3.0.3:*:*:*:*:*:*:*
History

07 Nov 2023, 02:16

Type Values Removed Values Added
References
  • {'url': 'https://groups.google.com/forum/#!msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ', 'name': 'https://groups.google.com/forum/#!msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ', 'tags': [], 'refsource': 'CONFIRM'}
  • () https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ -
Information

Published : 2013-12-31 20:55

Updated : 2024-02-28 12:00

NVD link : CVE-2013-3667

Mitre link : CVE-2013-3667

CVE.ORG link : CVE-2013-3667

JSON object : View

Products Affected

barebones

  • textwrangler
  • yojimbo
  • bbedit
CWE
CWE-20

Improper Input Validation