Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

16 ℃

95%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 07:30:01

[USD] USD 60,359.77

[BRL] BRL 313,031.81 [USD] USD 60,359.77 [GBP] GBP 45,723.61 [EUR] EUR 52,996.00
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 07:46:53 up 280 days, 16:18, 7 users, load average: 0.00, 0.00, 0.00

[26/06/2026 17:41] Leia a íntegra da carta de Marco Rubio para Flávio Bolsonaro - Poder360

[26/06/2026 21:24] Família diz que pastor brasileiro morreu em terremoto na Venezuela - CNN Brasil

[26/06/2026 09:41] A 1ª pesquisa AtlasIntel sobre o vídeo de Michelle contra Flávio Bolsonaro - CartaCapital

[26/06/2026 13:14] Lula diz que vai ampliar gastos em defesa porque 'está cheio de maluco no mundo': 'Não quero guerra nem ser pego de surpresa' - O GLOBO

[26/06/2026 20:45] EUA volta a bombardear Irã e países trocam acusações - Correio Braziliense

[26/06/2026 22:00] CNN Brasil visita ala da Papudinha após chegada de Vorcaro - CNN Brasil

[26/06/2026 16:50] Jaques Wagner admite relação com Augusto Lima e critica “patacoada” da PF - Poder360

[26/06/2026 08:56] Brasil x Japão: Servidores federais serão liberados às 11h na segunda (29) - Correio Braziliense

[27/06/2026 00:00] Como ChatGPT identificou plano de pai para matar o filho e levou alerta para autoridades - G1

[26/06/2026 11:39] Caso do filme 'Dark Horse' pode levar PF a abrir até 3 inquéritos nos próximos dias - G1

[CVE-2025-15509] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.

[CVE-2025-15567] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.

[CVE-2026-3302] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown functionality of the file /register.php of the component Sign Up Page. Executing a manipulation of the argument Email can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

[CVE-2025-13327] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.

[CVE-2025-9907] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.7:MEDIUM] A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.

[CVE-2025-9908] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.7:MEDIUM] A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-*) and event stream URLs via crafted requests and job templates. By exfiltrating these headers, an attacker could spoof trusted requests, escalate privileges, or perform malicious event injection.

[CVE-2025-9909] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.7:MEDIUM] A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

[CVE-2026-0871] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.9:MEDIUM] A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

[CVE-2026-27776] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesigner is deployed on the system. Arbitrary code may be executed when some crafted file is imported by a user with the administrative privilege.

[CVE-2025-12150] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.1:LOW] A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

[CVE-2026-1626] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.

[CVE-2026-1627] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allowing manipulation of transmitted data if the attacker can interact with the network traffic.

[CVE-2026-21654] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

[CVE-2026-21656] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

[CVE-2026-21657] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

[CVE-2026-21658] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.

[CVE-2026-2251] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads https://www.support.xerox.com/en-us/product/core/downloads

[CVE-2026-2252] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads

[CVE-2026-21659] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.

[CVE-2026-21660] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.