p PatchFirst

CVE-2018-6353

CVE-2018-6353

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering attacks in which a user pastes code that they do not understand and (2) code pasted by a physically proximate attacker at an unattended workstation, which makes it easier for attackers to steal Bitcoin via hook code that runs at a later time when the wallet password has been entered, a different vulnerability than CVE-2018-1000022.

CVSS 7.8 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • electrum Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.2.3-1

    Update to 3.2.3-1

  • electrum Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.2.3-1

    Update to 3.2.3-1

  • electrum Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.2.3-1

    Update to 3.2.3-1

Original sources

Check your server →