Code injection

bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call...

Stack overflow

bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled SOCKS proxy server is used. This results from an integer signedness error when the proxy server responds with an acknowledgement of an unexpected target domain name...

Design/Logic Flaw

bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service disabled functionality such as a client application crash via an "Easy" attack...

CVE-2015-3641

CVE-2015-3641 affects bitcoind and Bitcoin-Qt prior to 0.10.2, allowing a denial-of-service via an “Easy” attack (attackers could disable functionality or crash the client). Connected sources indicate the vulnerability is tied to older Bitcoin Core versions and that mitigation is to upgrade to ve...

CVE-2015-3641

bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service disabled functionality such as a client application crash via an "Easy" attack...

CVE-2015-3641

Removed by vendor...

CVE-2018-20586

CVE-2018-20586 affects bitcoind and Bitcoin-Qt prior to 0.17.1, where an RPC call can inject arbitrary data into the debug log. Affected component: Bitcoin Core’s RPC/debug logging. Root cause: ability to write arbitrary data via RPC into logs. Impact: log contents could be polluted with attacker...

CVE-2018-20586

bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call...

CVE-2017-18350

bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled SOCKS proxy server is used. This results from an integer signedness error when the proxy server responds with an acknowledgement of an unexpected target domain name...

CVE-2017-18350

Affected software: bitcoind and Bitcoin-Qt prior to 0.15.1. Issue: a stack-based buffer overflow caused by a signedness error when a attacker-controlled SOCKS proxy responds with an acknowledgement to an unexpected domain name. Impact details are consistent with the CVE, including a partial avail...

CVE-2017-18350

Removed by vendor...

DEBIAN-CVE-2018-17144

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service application crash exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash...

CVE-2018-17144

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service application crash exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash...

CVE-2013-5700

The Bloom Filter implementation in bitcoind and Bitcoin-Qt 0.8.x before 0.8.4rc1 allows remote attackers to cause a denial of service divide-by-zero error and daemon crash via a crafted sequence of messages...

Один сервер, Tor и Bitcoin

Всем доброго времени суток. В последнее время достаточно много новостей о Tor и Bitcoin, обе системы в достаточной мере направлены на безопасность и анонимность, однако их преимущества могут одновременно стать и недостатками. Структура Tor не позволяет определять местоположение клиента и сервера,...

CVE-2013-3220

bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8rc2, 0.6.x before 0.6.5rc2, and 0.7.x before 0.7.3rc2, and wxBitcoin, do not properly consider whether a block's size could require an excessive number of database locks, which allows remote attackers to cause a denial of service split an...

CVE-2013-4165

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack...

CVE-2013-3219

bitcoind and Bitcoin-Qt 0.8.x before 0.8.1 do not enforce a certain block protocol rule, which allows remote attackers to bypass intended access restrictions and conduct double-spending attacks via a large block that triggers incorrect Berkeley DB locking in older product versions...

CVE-2013-4627

Unspecified vulnerability in bitcoind and Bitcoin-Qt 0.8.x allows remote attackers to cause a denial of service memory consumption via a large amount of tx message data...

CVE-2013-4165

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack...