CVE-2018-20421: Allocation of Resources Without Limits or Throttling

Go Ethereum aka geth 1.8.19 allows attackers to cause a denial of service memory consumption by rewriting the length of a dynamic array in memory, and then writing data to a single memory location with a large index number, as demonstrated by use of "assembly mstore " followed by a "c0xC800000 =...

PT-2018-15365

Name of the Vulnerable Software and Affected Versions Go Ethereum aka geth version 1.8.19 Description The issue allows attackers to cause a denial of service due to memory consumption. This can be achieved by rewriting the length of a dynamic array in memory and then writing data to a single memo...

CVE-2018-19184

cmd/evm/runner.go in Go Ethereum aka geth 1.8.17 allows attackers to cause a denial of service SEGV via crafted bytecode...

CVE-2018-19184

CVE-2018-19184 affects Go Ethereum (geth) prior to or including 1.8.17, specifically in cmd/evm/runner.go. The vulnerability allows an attacker to trigger a denial-of-service (SEGV) through specially crafted bytecode, as documented in multiple sources (NVD entry for CVE-2018-19184 and SUSE/GHSA e...

CVE-2018-19184: NULL Pointer Dereference

cmd/evm/runner.go in Go Ethereum aka geth 1.8.17 allows attackers to cause a denial of service SEGV via crafted bytecode...

Design/Logic Flaw

In Go Ethereum aka geth before 1.8.14, TraceChain in eth/apitracer.go does not verify that the end block is after the start block...

CVE-2018-16733

CVE-2018-16733 affects go-ethereum (geth) prior to 1.8.14, where TraceChain in eth/api_tracer.go does not verify that the end block is after the start block. The vulnerability’s root cause is improper validation in the tracing path, potentially enabling malformed block processing and, in some des...

CVE-2018-16733: Improper Input Validation

In Go Ethereum aka geth before 1.8.14, TraceChain in eth/apitracer.go does not verify that the end block is after the start block...

EPoD: Ethereum Packet of Death (CVE-2018-12018)

PeckShield has so far discovered quite a few critical smart contract vulnerabilities. Besides smart contracts, the Ethereum ecosystem also includes other various components that are equally exposed to possible exploitation. Obviously, one such component is the core of Ethereum, i.e., the underlyi...

CVE-2018-12018: Improper Validation of Array Index

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum aka geth before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip...

Hackers Stole Over $20 Million in Ethereum from Insecurely Configured Clients

Security researchers have been warning about cybercriminals who have made over 20 million dollars in just past few months by hijacking insecurely configured Ethereum nodes exposed on the Internet. Qihoo 360 Netlab in March tweeted about a group of cybercriminals who were scanning the Internet for...