CVE-2013-3220: Medium severity bitcoin core vulnerability
bitcoind and Bitcoin-Qt before 0.4.9rc2, 0.5.x before 0.5.8rc2, 0.6.x before 0.6.5rc2, and 0.7.x before 0.7.3rc2, and wxBitcoin, do not properly consider whether a block's size could require an excessive number of database locks, which allows remote attackers to cause a denial of service (split) and enable certain double-spending capabilities via a large block that triggers incorrect Berkeley DB locking.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3220?
CVE-2013-3220 is considered a high severity vulnerability that could lead to a denial of service attack.
How do I fix CVE-2013-3220?
To fix CVE-2013-3220, update Bitcoin Core to version 0.4.9rc2 or later, or any version in the 0.5.x, 0.6.x, and 0.7.x series that is at least 0.5.8rc2, 0.6.5rc2, or 0.7.3rc2 respectively.
Who is affected by CVE-2013-3220?
CVE-2013-3220 affects Bitcoin clients such as Bitcoin-Qt and bitcoind versions prior to specific releases including 0.4.9rc2, 0.5.8rc2, 0.6.5rc2, and 0.7.3rc2.
What impact does CVE-2013-3220 have on systems?
CVE-2013-3220 allows remote attackers to induce a denial of service condition by exploiting the excessive number of database locks.
Is CVE-2013-3220 still a threat in current Bitcoin software?
No, CVE-2013-3220 is not a threat in current versions of Bitcoin software that have been updated beyond the vulnerable versions mentioned.