CVE-2013-3667

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-12-31 · updated 2026-06-16
Weakness: CWE-20

Description

The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.

Affected products

BareBones BBEdit: through 10.5.4; 10.0, 10.0.1, 10.1, 10.1.1, 10.1.2, 10.5 (+3)
BareBones Textwrangler: through 4.5.2; 2.3, 3.0, 3.1, 3.5, 3.5.1, 3.5.3 (+4)
BareBones Yojimbo: through 3.0.4; 1.4, 1.4.1, 1.4.2, 1.5, 1.5.1, 1.5.2 (+7)

References

http://www.barebones.com/support/bbedit/arch_bbedit1055.html
http://www.barebones.com/support/textwrangler/notes_tw453.html
http://www.barebones.com/support/yojimbo/arch_yojimbo40.html
https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ
http://www.barebones.com/support/bbedit/arch_bbedit1055.html
http://www.barebones.com/support/textwrangler/notes_tw453.html
http://www.barebones.com/support/yojimbo/arch_yojimbo40.html
https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ

Get alerted when CVE-2013-3667 or the next vulnerability affects your stack