Odaily Planet Daily reports: On October 24, the Bitcoin software wallet Electrum released version 4.8.3 to fix a critical vulnerability. Malicious servers could exploit this vulnerability to alter unconfirmed transactions, redirecting users' funds to attacker-controlled addresses; the vulnerability affects all versions prior to 4.8.3.
Attackers can intercept payments broadcast by users through a controlled server and inject fraudulent conflicting transactions that appear to have zero fees. If users increase the fee for a seemingly stuck transaction, sign, and broadcast the new transaction, it may send funds to the attacker’s address. At least one user reported losing funds on October 18 due to this issue.
This patch will verify signatures of inputs owned by the wallet before adding unconfirmed transactions to the local record; transactions originating from external senders with inputs not belonging to the user’s wallet are still not being validated for signatures. Electrum developer SomberNight stated that closing this gap requires additional work. (Decrypt)