rpm package
opensuse/bitcoin&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/bitcoin&distro=openSUSE%20Leap%2016.0
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-35202 | Hig | 7.5 | < 27.1-bp160.2.1 | 27.1-bp160.2.1 | Oct 10, 2024 | Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDow | |
| CVE-2023-37192 | Hig | 7.5 | < 27.1-bp160.2.1 | 27.1-bp160.2.1 | Jul 7, 2023 | Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing. | |
| CVE-2021-3195 | Hig | 7.5 | < 27.1-bp160.2.1 | 27.1-bp160.2.1 | Jan 26, 2021 | bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that | |
| CVE-2020-14198 | Hig | 7.5 | < 27.1-bp160.2.1 | 27.1-bp160.2.1 | Sep 10, 2020 | Bitcoin Core 0.20.0 allows remote denial of service. | |
| CVE-2019-15947 | Hig | 7.5 | < 27.1-bp160.2.1 | 27.1-bp160.2.1 | Sep 5, 2019 | In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it may dump a core file. If a user were to mishandle a core file, an attacker can reconstruct the user's wallet.dat file, including their private keys, via a grep "6231 0500" command. | |
| CVE-2018-20587 | Med | 5.5 | < 27.1-bp160.2.1 | 27.1-bp160.2.1 | Feb 11, 2019 | Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port. |
- affected < 27.1-bp160.2.1fixed 27.1-bp160.2.1
Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDow
- affected < 27.1-bp160.2.1fixed 27.1-bp160.2.1
Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.
- affected < 27.1-bp160.2.1fixed 27.1-bp160.2.1
bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that
- affected < 27.1-bp160.2.1fixed 27.1-bp160.2.1
Bitcoin Core 0.20.0 allows remote denial of service.
- affected < 27.1-bp160.2.1fixed 27.1-bp160.2.1
In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it may dump a core file. If a user were to mishandle a core file, an attacker can reconstruct the user's wallet.dat file, including their private keys, via a grep "6231 0500" command.
- affected < 27.1-bp160.2.1fixed 27.1-bp160.2.1
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.