Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

27 ℃

51%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 13:30:01

[USD] USD 79,970.82

[BRL] BRL 394,991.88 [USD] USD 79,970.82 [GBP] GBP 58,788.55 [EUR] EUR 67,994.63
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 13:32:31 up 229 days, 22:03, 3 users, load average: 0.00, 0.00, 0.00

[07/05/2026 11:25] Anvisa determina recolhimento de produtos da marca Ypê e suspende fabricação dos itens; veja quais - O Globo

[07/05/2026 12:00] Mendonça diz que relação de Ciro Nogueira e Vorcaro “extrapola amizade” - Poder360

[07/05/2026 09:22] Lula e Trump se reúnem na Casa Branca para discutir minerais críticos, Pix, segurança e tarifas - O Globo

[06/05/2026 23:16] André Mendonça discute com advogados de Vorcaro por conta de delação - Correio Braziliense

[07/05/2026 11:21] Democratas alertam Rubio contra classificação do PCC e CV como terroristas - CNN Brasil

[07/05/2026 12:31] Juíza do TJ/RS morre após coleta de óvulos para fertilização in vitro - Migalhas

[06/05/2026 17:53] 'Não era pra ter saído viva', diz patroa que torturou e agrediu empregada doméstica grávida - O Globo

[07/05/2026 03:33] Frio intenso atinge o Brasil logo antes do fim de semana do Dia das Mães - CNN Brasil

[06/05/2026 23:26] Queda de égua em adutora faz fake news sobre Copasa se espalharem nas redes - Estado de Minas

[06/05/2026 21:07] Câmara aprova fundo de R$ 5 bi e controle da União sobre minerais críticos - Poder360

[CVE-2025-15479] [Modified: 29-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.

[CVE-2025-62327] [Modified: 29-01-2026] [Analyzed] [V3.1 S4.9:MEDIUM] In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.

[CVE-2025-66838] [Modified: 21-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unrestricted rate. An attacker can exploit this behavior to rapidly upload a large volume of files, potentially leading to resource exhaustion such as disk space depletion, increased server load, or degraded performance

[CVE-2025-61489] [Modified: 29-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafted command string.

[CVE-2025-65805] [Modified: 29-01-2026] [Analyzed] [V3.1 S7.5:HIGH] OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF.

[CVE-2025-66686] [Modified: 21-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject malicious JavaScript code into the “Help button url” setting within the admin panel. The injected payload is stored and executed when any authenticated user clicks the Help button, potentially leading to session hijacking, information disclosure, privilege escalation, and unauthorized administrative actions.

[CVE-2025-66786] [Modified: 29-01-2026] [Analyzed] [V3.1 S7.5:HIGH] OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack.

[CVE-2025-66837] [Modified: 21-01-2026] [Analyzed] [V3.1 S6.8:MEDIUM] A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware

[CVE-2025-67364] [Modified: 29-01-2026] [Analyzed] [V3.1 S7.5:HIGH] fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. The safePath and isPathAllowed functions use path.resolve() which does not handle symlinks, allowing attackers to bypass directory access restrictions by creating symlinks within allowed directories that point to restricted system paths. When these symlinks are accessed through valid path references, the validation checks are circumvented, enabling access to unauthorized files.

[CVE-2025-67366] [Modified: 29-01-2026] [Analyzed] [V3.1 S7.5:HIGH] @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks path validity before resolving symlinks, while fs.readFile resolves symlinks automatically during file access. This allows attackers to bypass directory restrictions by leveraging symlinks within the allowed directory that point to external files, enabling unauthorized access to files outside the intended operational scope.

[CVE-2026-0618] [Modified: 30-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.

[CVE-2025-58441] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker should be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.

[CVE-2025-61492] [Modified: 30-01-2026] [Analyzed] [V3.1 S10.0:CRITICAL] A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

[CVE-2025-61782] [Modified: 20-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.

[CVE-2025-66560] [Modified: 03-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.

[CVE-2026-0668] [Modified: 24-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.This issue affects MediaWiki - VisualData Extension: 1.45.

[CVE-2026-0669] [Modified: 23-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

[CVE-2026-21495] [Modified: 09-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to division by zero in the TIFF Image Reader. This issue has been patched in version 2.3.1.2.

[CVE-2026-21496] [Modified: 09-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via the signature parser. This issue has been patched in version 2.3.1.2.

[CVE-2026-21497] [Modified: 09-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via an unknown tag parser. This issue has been patched in version 2.3.1.2.