Andrew Chow

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.19.0 Description: The issue might allow remote attackers to execute arbitrary code when another application unsafely passes the `-platformpluginpath` argument to the `bitcoin-qt` program. This could be demonstrated by an `x-scheme-handler/bitcoin` handler for a `.desktop` file or a web browser. The discoverer notes that they believe this issue cannot actually be exploited. Recommendations: For versions prior to 0.19.0, update to version 0.19.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `-platformpluginpath` argument in the `bitcoin-qt` program to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Bitcoin Core versions prior to 0.13.0 Bitcoin Knots versions prior to 0.13.0.knots20160814 **Description** The issue allows for denial of service through memory exhaustion, triggered by the remote network alert system. This system is deprecated since Q1 2016. An attacker can exploit this by signing a message with a certain private key that had been known by unintended actors, due to an infinitely sized map. This affects not only Bitcoin Core but also other uses of the codebase, including Bitcoin Knots and many altcoins. **Recommendations** For Bitcoin Core versions prior to 0.13.0, update to version 0.13.0 or later. For Bitcoin Knots versions prior to 0.13.0.knots20160814, update to version 0.13.0.knots20160814 or later.