What’s Vulnerable › Vulnerabilities

CVE-2015-6964

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-25 · updated 2026-06-17
• Weakness: CWE-697

Description

MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC).

Affected products

• Multibit Hd: before 0.1.2 — fixed in 0.1.2

How to fix

Upgrade to a fixed version: Multibit Hd 0.1.2. Check the vendor advisory for mitigations.

References

• https://web.archive.org/web/20160506095434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html
• https://web.archive.org/web/20160506095434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html

Get alerted when CVE-2015-6964 or the next vulnerability affects your stack