Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

16 ℃

99%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 05:00:02

[USD] USD 60,117.85

[BRL] BRL 311,777.16 [USD] USD 60,117.85 [GBP] GBP 45,540.35 [EUR] EUR 52,783.59
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 05:25:31 up 281 days, 13:56, 7 users, load average: 0.00, 0.00, 0.00

[27/06/2026 20:38] Trump anuncia retomada de ataques no Oriente Médio e ameaça ‘existência’ do Irã - Estadão

[27/06/2026 21:43] Mortos por terremotos na Venezuela passam de 1.400 enquanto equipes de resgate correm para encontrar sobreviventes - BBC

[27/06/2026 18:12] Polícia Civil identifica homens mortos em frente a condomínio no Recreio - O Globo

[27/06/2026 20:40] Calor atinge níveis jamais vistos na Alemanha e Dinamarca - MetSul Meteorologia

[27/06/2026 18:48] Relembre caso de Eloá Pimentel, irmã de tenente da Rota baleado em SP - CNN Brasil

[27/06/2026 17:04] Fux vota e STF forma maioria para liberar parte dos ‘penduricalhos’ a juízes e membros do MP - Estadão

[27/06/2026 12:17] Alcides Fernandes chama de 'infeliz' vídeo publicado por Michelle e diz que Bolsonaro autorizou apoio a Ciro no Ceará - G1

[27/06/2026 14:09] Neonazista brasileiro condenado por assassinato é preso na Itália - CartaCapital

[27/06/2026 03:55] Rubio reafirma tarifaço em carta a Flávio Bolsonaro e cita PCC e CV - Correio Braziliense

[27/06/2026 05:41] Domiciliar de Bolsonaro chega ao prazo com direita desorganizada e Michelle protagonista de crise - Estadão

[CVE-2026-2844] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.

[CVE-2026-3010] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2.

[CVE-2026-28554] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.

[CVE-2026-28555] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

[CVE-2026-28556] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.

[CVE-2026-28557] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

[CVE-2026-28558] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.4:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.

[CVE-2026-28559] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

[CVE-2026-28560] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.

[CVE-2026-28561] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.

[CVE-2026-28562] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

[CVE-2026-3376] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-3377] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

[CVE-2026-3378] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

[CVE-2026-3379] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

[CVE-2026-3380] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

[CVE-2026-3382] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the file include/chaiscript/dispatchkit/boxed_number.hpp. Performing a manipulation results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3383] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A weakness has been identified in ChaiScript up to 6.1.0. This affects the function chaiscript::Boxed_Number::go of the file include/chaiscript/dispatchkit/boxed_number.hpp. Executing a manipulation can lead to divide by zero. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3384] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A security vulnerability has been detected in ChaiScript up to 6.1.0. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Function_Push_Pop of the file include/chaiscript/language/chaiscript_eval.hpp. The manipulation leads to uncontrolled recursion. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3385] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.