medium5.0
CVE-2013-2293
The CTransaction::FetchInputs method in bitcoind and Bitcoin-Qt before 0.8.0rc1 copies transactions from disk to memory without incrementally checking for spen…
Impact
The CTransaction::FetchInputs method in bitcoind and Bitcoin-Qt before 0.8.0rc1 copies transactions from disk to memory without incrementally checking for spent prevouts, which allows remote attackers to cause a denial of service (disk I/O consumption) via a Bitcoin transaction with many inputs corresponding to many different parts of the stored block chain.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bitcoin | Bitcoin-Qt | Versions 0.4, 0.4.8, 0.5.0, 0.5.0.4, 0.5.1, 0.5.3.0 |
| Bitcoin | Bitcoin Core | All versions through 0.7.2 Versions 0.3.4, 0.3.5, 0.3.8, 0.3.10 |
| Bitcoin | Bitcoind | Versions 0.4.4, 0.5.7, 0.6.0.0, 0.6.0.10, 0.6.3, 0.6.4 |