CVE-2013-3667

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.barebones.com/support/bbedit/arch_bbedit1055.htmlVendor Advisory
http://www.barebones.com/support/textwrangler/notes_tw453.htmlVendor Advisory
http://www.barebones.com/support/yojimbo/arch_yojimbo40.htmlVendor Advisory
https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ
http://www.barebones.com/support/bbedit/arch_bbedit1055.htmlVendor Advisory
http://www.barebones.com/support/textwrangler/notes_tw453.htmlVendor Advisory
http://www.barebones.com/support/yojimbo/arch_yojimbo40.htmlVendor Advisory
https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ

Timeline

Published: Dec 31, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-36704.3The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which al CVE-2013-36714.3The format_line function in log.c in libavutil in FFmpeg before 1.2.1 uses inapplicable offset data during a certain category calculation, w CVE-2013-36724.3The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coord CVE-2013-36734.3The gif_decode_frame function in gifdec.c in libavcodec in FFmpeg before 1.2.1 does not properly manage the disposal methods of frames, whic CVE-2013-36744.3The cdg_decode_frame function in cdgraphics.c in libavcodec in FFmpeg before 1.2.1 does not validate the presence of non-header data in a bu CVE-2013-36754.3The process_frame_obj function in sanm.c in libavcodec in FFmpeg before 1.2.1 does not validate width and height values, which allows remote CVE-2013-36789.0Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticated users to gain privileges and e CVE-2013-36849.8NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload CVE-2013-36857.0A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android sm CVE-2013-368610.0cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password vi CVE-2013-36877.8AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD, POE100HD, and possibly other camera models use cleartext to store sen CVE-2013-36887.1The TP-Link IP Cameras TL-SC3171, TL-SC3130, TL-SC3130G, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6, does