CVE-2013-2293: Medium severity bitcoin core vulnerability
The CTransaction::FetchInputs method in bitcoind and Bitcoin-Qt before 0.8.0rc1 copies transactions from disk to memory without incrementally checking for spent prevouts, which allows remote attackers to cause a denial of service (disk I/O consumption) via a Bitcoin transaction with many inputs corresponding to many different parts of the stored block chain.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2293?
CVE-2013-2293 has not been assigned a specific CVSS score, but it poses a significant denial of service risk to affected Bitcoin applications.
How do I fix CVE-2013-2293?
You should upgrade to Bitcoin Core version 0.8.0rc1 or later to mitigate the vulnerability associated with CVE-2013-2293.
What software is affected by CVE-2013-2293?
CVE-2013-2293 affects multiple versions of Bitcoin Core and Bitcoin-Qt, specifically versions prior to 0.8.0rc1.
What type of attack does CVE-2013-2293 facilitate?
CVE-2013-2293 allows remote attackers to conduct denial of service attacks by exploiting transaction processing methods.
Is there a patch available for CVE-2013-2293?
Yes, a patch is included in Bitcoin Core version 0.8.0rc1 and subsequent releases.