Bbedit
Monthly
Infinite loop denial-of-service in BBEdit's Lasso Language Tokenizer affects all versions up to 15.5.5, allowing a remote attacker to hang the application by delivering a specially crafted Lasso language file that the victim opens. The vulnerability is limited to application-level availability loss with no confidentiality or integrity impact, and requires user interaction to trigger. No active exploitation has been identified; vendor-released fix is available in BBEdit 16.0.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Infinite loop denial-of-service in BBEdit's Lasso Language Tokenizer affects all versions up to 15.5.5, allowing a remote attacker to hang the application by delivering a specially crafted Lasso language file that the victim opens. The vulnerability is limited to application-level availability loss with no confidentiality or integrity impact, and requires user interaction to trigger. No active exploitation has been identified; vendor-released fix is available in BBEdit 16.0.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.