Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

22 ℃

43%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 13:00:02

[USD] USD 78,793.10

[BRL] BRL 388,150.56 [USD] USD 78,793.10 [GBP] GBP 58,274.51 [EUR] EUR 67,274.10
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 13:16:19 up 235 days, 21:47, 3 users, load average: 0.02, 0.03, 0.00

[13/05/2026 11:25] Genial/Quaest: Lula ultrapassa Flávio numericamente no 2º turno, mas empate permanece - Valor Econômico

[13/05/2026 08:04] Indústria de SP pede que Congresso "devolva" MP que zera taxa das blusinhas - CNN Brasil

[13/05/2026 06:50] PF apura possível gestão temerária em instituto de previdência de Cajamar/SP — Polícia Federal - www.gov.br

[13/05/2026 09:14] Genial/Quaest: entenda os fatores que melhoraram desempenho de Lula - Metrópoles

[13/05/2026 01:59] Gusttavo Lima e Macallan: a festa de Nunes Marques após posse no TSE - Poder360

[13/05/2026 08:00] Quaest: para 43%, Lula saiu mais forte após encontro com Trump - G1

[13/05/2026 00:01] Lula destina equivalente a 0,73% do lucro anual das organizações criminosas para combatê-las - Diário do Poder

[12/05/2026 10:04] Quem era homem que morreu após explosão na zona Oeste de SP - CNN Brasil

[13/05/2026 08:08] Câmeras, doença grave e fake news: o que levou MP a pedir arquivamento do caso Orelha - NSC Total

[13/05/2026 07:48] Entenda como a China se prepara para receber Trump que se reunirá com Xi - CNN Brasil

[CVE-2025-13774] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands.

[CVE-2025-11250] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.1:CRITICAL] Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.

[CVE-2025-11669] [Modified: 02-02-2026] [Analyzed] [V3.1 S8.1:HIGH] Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.

[CVE-2025-9435] [Modified: 29-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module

[CVE-2025-13444] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.4:HIGH] OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

[CVE-2025-13447] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.4:HIGH] OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

[CVE-2025-55462] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.

[CVE-2024-54855] [Modified: 10-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with other hosts.

[CVE-2025-65783] [Modified: 05-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.

[CVE-2025-66698] [Modified: 05-02-2026] [Analyzed] [V3.1 S8.6:HIGH] An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.

[CVE-2025-68817] [Modified: 26-02-2026] [Analyzed] [V3.1 S7.8:HIGH] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it.

[CVE-2025-68823] [Modified: 26-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_open() grabs disk->open_mutex 2. The process issues read I/O to ublk backend to read partition table 3. In __ublk_complete_rq(), blk_update_request() or blk_mq_end_request() runs bio->bi_end_io() callbacks 4. If this triggers fput() on file descriptor of ublk block device, the work may be deferred to current task's task work (see fput() implementation) 5. This eventually calls blkdev_release() from the same context 6. blkdev_release() tries to grab disk->open_mutex again 7. Deadlock: same task waiting for a mutex it already holds The fix is to run blk_update_request() and blk_mq_end_request() with bottom halves disabled. This forces blkdev_release() to run in kernel work-queue context instead of current task work context, and allows ublk server to make forward progress, and avoids the deadlock. [axboe: rewrite comment in ublk]

[CVE-2025-69990] [Modified: 16-01-2026] [Analyzed] [V3.1 S9.1:CRITICAL] phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.

[CVE-2025-69991] [Modified: 16-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.

[CVE-2025-69992] [Modified: 16-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.

[CVE-2025-70753] [Modified: 16-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security_5g parameter of the sub_4CA50 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-71023] [Modified: 20-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-71024] [Modified: 16-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the serviceName2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-71025] [Modified: 16-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.

[CVE-2025-71026] [Modified: 16-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.