Описание
Security update for bitcoin
This update for bitcoin fixes the following issues:
Changes in bitcoin:
- Reference the tracking bugs for CVEs already fixed in current bitcoin
(the affected versions all predate the shipped release):
- CVE-2018-20587 (boo#1125092)
- CVE-2019-15947 (boo#1149711)
- CVE-2020-14198 (boo#1181786)
- CVE-2021-3195 (boo#1181784)
- CVE-2023-37192 (boo#1217678)
- CVE-2024-35202 (boo#1231507)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1125092
- SUSE Bug 1149711
- SUSE Bug 1181784
- SUSE Bug 1181786
- SUSE Bug 1217678
- SUSE Bug 1231507
- SUSE CVE CVE-2018-20587 page
- SUSE CVE CVE-2019-15947 page
- SUSE CVE CVE-2020-14198 page
- SUSE CVE CVE-2021-3195 page
- SUSE CVE CVE-2023-37192 page
- SUSE CVE CVE-2024-35202 page
Описание
Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 through 0.17.x before 0.17.1.knots20181229 have Incorrect Access Control. Local users can exploit this to steal currency by binding the RPC IPv4 localhost port, and forwarding requests to the IPv6 localhost port.
Затронутые продукты
Ссылки
- CVE-2018-20587
- SUSE Bug 1125092
Описание
In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. Upon a crash, it may dump a core file. If a user were to mishandle a core file, an attacker can reconstruct the user's wallet.dat file, including their private keys, via a grep "6231 0500" command.
Затронутые продукты
Ссылки
- CVE-2019-15947
- SUSE Bug 1149711
Описание
Bitcoin Core 0.20.0 allows remote denial of service.
Затронутые продукты
Ссылки
- CVE-2020-14198
- SUSE Bug 1181786
Описание
bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call. NOTE: this reportedly does not violate the security model of Bitcoin Core, but can violate the security model of a fork that has implemented dumpwallet restrictions
Затронутые продукты
Ссылки
- CVE-2021-3195
- SUSE Bug 1181784
Описание
Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing.
Затронутые продукты
Ссылки
- CVE-2023-37192
- SUSE Bug 1217678
Описание
Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instance.
Затронутые продукты
Ссылки
- CVE-2024-35202
- SUSE Bug 1231507