Sparkle vulnerability and list of safe apps (Updated!)

Published on February 15, 2016 in Posts
Updated on: February 19, 2016
Read time: 1 min
Tags: Security macOS

Many OS X apps use Sparkle as update library.

Recently a vulnerability in the software has been discovered. Affected apps are those using a vulnerable version of Sparkle on an unencrypted HTTP connection to receive data from their update servers. Those apps are subject to man-in-the-middle attacks that could install malicious code.

You can read more about this security issue on ArsTecnica.

List of safe apps (Updated!)

In alphabetical order, the minimum safe versions of apps using Sparkle.

App name / Safe since / Notes

CodeKit 1.7.1, prior releases should be unaffected
Dash 3.2.2
iTerm 2.1.4 and 2.9
SourceTree 2.2
Spectacle 1.0.2
VLC 2.2.2

Post constantly updated as I discover new safe versions.