Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

12 ℃

97%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 09:00:02

[USD] USD 61,189.92

[BRL] BRL 317,936.71 [USD] USD 61,189.92 [GBP] GBP 46,516.88 [EUR] EUR 53,986.40
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 09:10:17 up 278 days, 17:41, 6 users, load average: 0.00, 0.00, 0.00

[25/06/2026 06:28] Terremoto na Venezuela provoca mais de 30 mortes, 700 feridos e é sentido no Brasil; o que se sabe - BBC

[25/06/2026 06:30] Operação mira cúpula de empresa de ônibus e vereador de SP por lavagem de dinheiro para o PCC - G1

[25/06/2026 07:15] PF deflagra operação sobre irregularidades nas Americanas - CNN Brasil

[25/06/2026 06:44] Se a ofendi, “peço desculpas", diz Flávio a Michelle - Poder360

[24/06/2026 18:04] Após reunião com Lula, Jaques Wagner deixa liderança no Senado - Correio Braziliense

[24/06/2026 20:05] 'Mulheres em casa': valentia de Bolsonaro desdiz enfermidade - UOL Notícias

[25/06/2026 07:29] PF mira deputado Josimar Maranhãozinho em operação contra corrupção - Metrópoles

[25/06/2026 07:15] Polícia investiga fraude de R$ 1 bilhão envolvendo banco extinto no RJ - CNN Brasil

[24/06/2026 22:52] Prefeito do Rio anuncia ponto facultativo para o próximo jogo do Brasil na Copa, segunda-feira - O Globo

[24/06/2026 18:53] Itamaraty reage à inscrição de Flávio para discursar em audiência sobre tarifaço nos EUA e fala em ‘traidores da pátria’ - O Globo

[CVE-2025-11563] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.6:MEDIUM] URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

[CVE-2026-3169] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A security vulnerability has been detected in Tenda F453 1.0.0.3. This impacts the function fromSafeEmailFilter of the file /goform/SafeEmailFilter of the component httpd. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

[CVE-2026-3170] [Modified: 17-06-2026] [Analyzed] [V3.1 S2.4:LOW] A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /patient-search.php. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used.

[CVE-2026-3171] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /queue.php. This manipulation of the argument firstname/lastname causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.

[CVE-2025-67601] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.3:HIGH] A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login command without also passing the –cacert flag results in the CLI attempting to fetch CA certificates stored in Rancher’s setting cacerts.

[CVE-2026-28193] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

[CVE-2026-28194] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow

[CVE-2026-28195] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations

[CVE-2026-28196] [Modified: 17-06-2026] [Analyzed] [V3.1 S2.3:LOW] In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk

[CVE-2026-3185] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.3-beta is able to address this issue. The patch is identified as aefaabfd7527188bfba3c8c9eee17c316d094802. The affected component should be upgraded. The project was informed beforehand and acted very professional: "We have implemented message ownership verification, so that users can only query messages related to themselves."

[CVE-2026-3186] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.3.3-beta addresses this issue. Patch name: aefaabfd7527188bfba3c8c9eee17c316d094802. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."

[CVE-2026-27691] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.2:MEDIUM] iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, signed integer overflow in iccFromCube.cpp during multiplication triggers undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing crafted/large cube inputs. Commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a fixes the issue. No known workarounds are available.

[CVE-2026-27692] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.1:HIGH] iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release() when strlen() reads past a heap buffer while parsing ICC profile XML text description tags, causing a crash. Commit 29d088840b962a7cdd35993dfabc2cb35a049847 fixes the issue. No known workarounds are available.

[CVE-2026-27695] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets for a single entity share the same DynamoDB partition key (`namespace/ENTITY#{id}`). A high-traffic entity can exceed DynamoDB's per-partition throughput limits (~1,000 WCU/sec), causing throttling that degrades service for that entity — and potentially co-located entities in the same partition. Version 0.10.1 fixes the issue.

[CVE-2026-27699] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.1:CRITICAL] The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.

[CVE-2026-2878] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.

[CVE-2026-3187] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys-file/upload of the component API Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.3.3-beta can resolve this issue. The name of the patch is aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is recommended. The project was informed beforehand and acted very professional: "We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads."

[CVE-2026-3201] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.7:MEDIUM] USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service

[CVE-2026-3202] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.7:MEDIUM] NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service

[CVE-2026-3203] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service