CVE-2013-3667: Input Validation

Q: What is the severity of CVE-2013-3667?

CVE-2013-3667 has been classified as a medium severity vulnerability.

Q: How do I fix CVE-2013-3667?

To fix CVE-2013-3667, update to the latest versions of the affected software, which include Yojimbo 4.0 and later, TextWrangler 4.5.3 and later, and BBEdit 10.5.5 and later.

Q: What software does CVE-2013-3667 affect?

CVE-2013-3667 affects Bare Bones Software Yojimbo, TextWrangler, and BBEdit versions prior to the specified secure releases.

Q: What type of attack is possible due to CVE-2013-3667?

CVE-2013-3667 allows attackers to perform tampering or corruption of software updates.

Q: Is CVE-2013-3667 still a risk if my software is updated?

No, if your software is updated to the fixed versions, CVE-2013-3667 should no longer pose a risk.

Published Dec 31, 2013

Updated

The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.

Affected Software

35 affected components

Barebones Textwrangler<=4.5.2

Barebones Textwrangler=2.3

Barebones Textwrangler=3.0

Barebones Textwrangler=3.1

Barebones Textwrangler=3.5

Barebones Textwrangler=3.5.1

Barebones Textwrangler=3.5.3

Barebones Textwrangler=4.0

Barebones Textwrangler=4.0.1

Barebones Textwrangler=4.5

Barebones Textwrangler=4.5.1

Barebones Bbedit<=10.5.4

Barebones Bbedit=10.0

Barebones Bbedit=10.0.1

Barebones Bbedit=10.1

Barebones Bbedit=10.1.1

Barebones Bbedit=10.1.2

Barebones Bbedit=10.5

Barebones Bbedit=10.5.1

Barebones Bbedit=10.5.2

Barebones Bbedit=10.5.3

Barebones Yojimbo<=3.0.4

Barebones Yojimbo=1.4

Barebones Yojimbo=1.4.1

Barebones Yojimbo=1.4.2

Barebones Yojimbo=1.5

Barebones Yojimbo=1.5.1

Barebones Yojimbo=1.5.2

Barebones Yojimbo=2.0

Barebones Yojimbo=2.1

Barebones Yojimbo=2.2

Barebones Yojimbo=3.0

Barebones Yojimbo=3.0.1

Barebones Yojimbo=3.0.2

Barebones Yojimbo=3.0.3

Event History

Dec 31, 2013

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3667?

CVE-2013-3667 has been classified as a medium severity vulnerability.

How do I fix CVE-2013-3667?

To fix CVE-2013-3667, update to the latest versions of the affected software, which include Yojimbo 4.0 and later, TextWrangler 4.5.3 and later, and BBEdit 10.5.5 and later.

What software does CVE-2013-3667 affect?