Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
chuva moderada

18 ℃

87%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 16:00:02

[USD] USD 79,247.11

[BRL] BRL 403,145.91 [USD] USD 79,247.11 [GBP] GBP 59,481.53 [EUR] EUR 68,187.07
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 16:21:52 up 238 days, 53 min, 3 users, load average: 0.00, 0.00, 0.00

[15/05/2026 13:23] Cláudio Castro é alvo de operação da PF que mira em fraudes no setor de combustíveis - O GLOBO

[15/05/2026 10:37] Mendonça se reúne com PF após vazamento de áudio de Flávio a Vorcaro - CNN Brasil

[15/05/2026 09:29] Lula chamou Magro de 'grande chefe do crime organizado' e disse ter pedido prisão a Trump - O GLOBO

[15/05/2026 10:17] Santuário suspende visitação após ataque de onça-parda a criança de 8 anos - Correio Braziliense

[15/05/2026 09:55] Alerta "severo" antecedeu desaparecimento de mergulhadores italianos nas Maldivas - NSC Total

[15/05/2026 10:02] PF procura 3 foragidos da operação que prendeu pai de Vorcaro - Revista Oeste

[15/05/2026 09:04] Flávio diz que Zema "foi precipitado" e agradece apoio de Caiado - Poder360

[15/05/2026 14:55] Michelle reage à notícia de possível chapa com Tereza Cristina - Metrópoles

[15/05/2026 11:33] Lula anuncia maior pacote de tratamentos contra o câncer da história do SUS - Brasil 247

[15/05/2026 13:18] As intenções de voto de Lula e Flávio Bolsonaro no Maranhão, segundo AtlasIntel - CartaCapital

[CVE-2021-47752] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the server by sending multiple concurrent HTTP requests. Attackers can generate high-volume requests to multiple endpoints including /mysqladmin to potentially crash or render the service unresponsive.

[CVE-2021-47753] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension checks. Attackers can upload a PHP file disguised as a PNG, rename it, and execute system commands through a crafted web shell parameter.

[CVE-2021-47757] [Modified: 23-01-2026] [Analyzed] [V3.1 S8.8:HIGH] Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server.

[CVE-2021-47758] [Modified: 03-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables arbitrary command execution on the server through a weaponized PHP script.

[CVE-2021-47767] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.8:HIGH] 10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute code with system-level permissions.

[CVE-2021-47768] [Modified: 30-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data or session credentials.

[CVE-2021-47772] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] 10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system.

[CVE-2021-47773] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Dynojet Power Core 2.3.0 contains an unquoted service path vulnerability in the DJ.UpdateService that allows local authenticated users to potentially execute code with elevated privileges. Attackers can exploit the unquoted binary path by placing malicious executables in the service's file path to gain Local System access.

[CVE-2021-47776] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.

[CVE-2021-47843] [Modified: 05-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers can execute arbitrary JavaScript code to spawn system processes, access files, and perform remote code execution on the victim's computer.

[CVE-2025-64516] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.5:HIGH] GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GLPI documents attached to any item (ticket, asset, ...). If the public FAQ is enabled, this unauthorized access can be performed by an anonymous user. This vulnerability is fixed in 10.0.21 and 11.0.3.

[CVE-2025-67076] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read.

[CVE-2025-67077] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.8:HIGH] File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions also guest users, via the UploadTmpFile action.

[CVE-2025-67079] [Modified: 21-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick library via crafted PDF file to the file upload and thumbnail functions.

[CVE-2025-66292] [Modified: 12-03-2026] [Analyzed] [V3.1 S8.1:HIGH] DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.

[CVE-2025-66417] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.5:HIGH] GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 11.0.3.

[CVE-2025-70298] [Modified: 23-01-2026] [Analyzed] [V3.1 S8.2:HIGH] GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.

[CVE-2025-70304] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

[CVE-2025-70305] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file.

[CVE-2025-70308] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.