Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

12 ℃

92%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 06:30:02

[USD] USD 61,153.29

[BRL] BRL 316,228.01 [USD] USD 61,153.29 [GBP] GBP 45,688.30 [EUR] EUR 52,936.49
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 06:34:05 up 263 days, 15:05, 5 users, load average: 0.02, 0.01, 0.00

[09/06/2026 20:23] PGR deve rejeitar nova proposta de delação de Vorcaro - Revista Oeste

[09/06/2026 23:24] Ministra do TSE pede vista e adia julgamento sobre pesquisa da AtlasIntel - Poder360

[09/06/2026 19:39] EUA atacam Irã em resposta à derrubada de helicóptero; Teerã promete reação - CartaCapital

[09/06/2026 04:00] Caso Henry: em lados opostos agora, Monique e Jairinho eram aliados - O Globo

[09/06/2026 17:59] Hugo diz que pediu ao governo retirada de urgência em PL da 6x1 - CNN Brasil

[09/06/2026 21:30] Protesto no plenário: servidores do BRB viram de costas para Paula Belmonte - Correio Braziliense

[10/06/2026 00:00] STF deve julgar nesta quarta recursos de big techs em ação que ampliou responsabilidades das plataformas - G1

[09/06/2026 22:03] Inmet emite alerta de tempestade com ventos de até 100 km/h em 4 estados - UOL Notícias

[09/06/2026 19:13] Sudeste e Centro-Oeste terão chuva atípica para junho nos próximos dias - Climatempo

[09/06/2026 13:44] PEC das igrejas pode aumentar o imposto de todos os brasileiros, alerta Durigan - CartaCapital

[CVE-2025-11142] [Modified: 28-02-2026] [Analyzed] [V3.1 S7.1:HIGH] The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.

[CVE-2025-11547] [Modified: 17-02-2026] [Analyzed] [V3.1 S7.8:HIGH] AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.

[CVE-2025-12757] [Modified: 17-02-2026] [Analyzed] [V3.1 S4.6:MEDIUM] An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.

[CVE-2025-13064] [Modified: 17-02-2026] [Analyzed] [V3.1 S4.5:MEDIUM] A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with.

[CVE-2025-12063] [Modified: 17-02-2026] [Analyzed] [V3.1 S5.7:MEDIUM] An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions.

[CVE-2026-2095] [Modified: 13-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Agentflow developed by Flowring has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to exploit a specific functionality to obtain arbitrary user authentication token and log into the system as any user.

[CVE-2026-2096] [Modified: 13-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.

[CVE-2026-2097] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

[CVE-2026-2098] [Modified: 13-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] AgentFlow developed by Flowring has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

[CVE-2026-2099] [Modified: 13-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.

[CVE-2026-23715] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds write vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

[CVE-2026-23716] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

[CVE-2026-23717] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

[CVE-2026-23718] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

[CVE-2026-23719] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

[CVE-2026-23720] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

[CVE-2026-23901] [Modified: 12-02-2026] [Analyzed] [V3.1 S2.5:LOW] Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.

[CVE-2026-24343] [Modified: 11-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

[CVE-2026-25655] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper modification of a configuration file by a low-privileged user. This could allow an attacker to load malicious DLLs, potentially leading to arbitrary code execution with administrative privilege.(ZDI-CAN-28107)

[CVE-2025-15571] [Modified: 29-04-2026] [Analyzed] [V3.1 S3.3:LOW] A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.