Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

19 ℃

57%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 12:30:02

[USD] USD 65,295.49

[BRL] BRL 331,178.73 [USD] USD 65,295.49 [GBP] GBP 48,749.68 [EUR] EUR 56,329.96
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 12:38:02 up 270 days, 21:09, 6 users, load average: 0.00, 0.00, 0.00

[17/06/2026 00:01] Lula cavou encontro com Trump, mas foi ignorado e passou vergonha na reunião do G7 - Diário do Poder

[17/06/2026 03:31] Relatório da PF expõe articulação e influência de Vorcaro no meio político - CNN Brasil

[16/06/2026 21:14] EUA e Irã fecham acordo que cria fundo bilionário - Poder360

[16/06/2026 16:48] STF decide manter prisão de pai e primo de Vorcaro em sessão marcada por divergência de ministros - Estadão

[16/06/2026 18:36] STF condena Eduardo Bolsonaro por articular ações do governo Trump contra o Brasil: o que pode acontecer com ele? - BBC

[16/06/2026 11:13] As intenções de voto de Lula e Flávio Bolsonaro no 2º turno, em nova pesquisa CNT/MDA - CartaCapital

[17/06/2026 03:00] Concurso do IBGE: veja cargos, salários e como se inscrever para mais de 8 mil vagas - G1

[17/06/2026 03:30] STF aguarda explicações de Bolsonaro sobre arma apreendida em blitz - CNN Brasil

[16/06/2026 19:12] PF prende casal por falsificação de alvarás de soltura no Rio; traficante de armas está entre os beneficiados - G1

[16/06/2026 19:59] Daniel Vorcaro mandou 'moer' empregada da atriz Monique Alfradique, diz PF - Estado de Minas

[CVE-2026-2615] [Modified: 18-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-25087] [Modified: 11-03-2026] [Analyzed] [V3.1 S7.0:HIGH] Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>` object) that is written to the dangling pointer is not under direct control of the attacker. Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable. The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker. Advice for users of Arrow C++: 1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`) 2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable

[CVE-2025-70829] [Modified: 23-02-2026] [Analyzed] [V3.1 S5.7:MEDIUM] An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string.

[CVE-2026-2616] [Modified: 29-04-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management Interface. The manipulation leads to hard-coded credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is advisable to modify the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-70828] [Modified: 03-04-2026] [Analyzed] [V3.1 S8.8:HIGH] An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration

[CVE-2026-2617] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2024-55271] [Modified: 23-02-2026] [Analyzed] [V3.1 S3.5:LOW] A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. This issue is present in the profile update functionality of the User Panel, specifically the /profile.php endpoint.

[CVE-2026-2618] [Modified: 29-04-2026] [Analyzed] [V3.1 S3.7:LOW] A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky cryptographic algorithm. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2024-55270] [Modified: 23-02-2026] [Analyzed] [V3.1 S8.8:HIGH] phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter.

[CVE-2025-13867] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic

[CVE-2025-14689] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic with federated objects.

[CVE-2025-36247] [Modified: 18-02-2026] [Analyzed] [V3.1 S7.1:HIGH] IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

[CVE-2025-36425] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration.

[CVE-2024-43178] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

[CVE-2025-36018] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

[CVE-2025-36019] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[CVE-2025-59793] [Modified: 03-04-2026] [Analyzed] [V3.1 S9.9:CRITICAL] Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution.

[CVE-2023-38265] [Modified: 23-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose folder location information to an unauthenticated attacker that could aid in further attacks against the system.

[CVE-2025-13108] [Modified: 26-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an attacker to access sensitive information in memory due to the buffer not properly clearing resources.

[CVE-2025-27898] [Modified: 26-02-2026] [Analyzed] [V3.1 S6.3:MEDIUM] IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 does not invalidate session after a timeout which could allow an authenticated user to impersonate another user on the system.