Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

18 ℃

95%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 02:00:02

[USD] USD 65,635.96

[BRL] BRL 332,439.57 [USD] USD 65,635.96 [GBP] GBP 48,801.91 [EUR] EUR 56,525.10
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 02:06:00 up 268 days, 10:37, 5 users, load average: 0.00, 0.00, 0.00

[14/06/2026 20:30] Trump anuncia acordo com Irã e fim de bloqueio naval em Ormuz - Poder360

[14/06/2026 21:34] Queda de helicópteros no Rio de Janeiro deixa 6 mortos; cantor americano Oliver Tree e YouTuber argentino estavam na lista de passageiros - BBC

[14/06/2026 14:39] Justiça decreta prisão preventiva de trio por morte de jovem em rope jump - CNN Brasil

[14/06/2026 08:23] Flávio Bolsonaro derrete em redutos bolsonaristas, aponta Quaest; PL já fala em “naufrágio” - Revista Fórum

[14/06/2026 13:23] Lula vai ao G7 com conversa com Trump ainda indefinida - Poder360

[14/06/2026 18:00] Flávio Gordon: 'Não há delação sem Moraes' - Revista Oeste

[14/06/2026 12:24] Maré alta coloca cidades de SC em alerta para risco de alagamentos - ND Mais

[14/06/2026 06:04] Veja quais países adotam maioridade penal inferior a 18 anos - Poder360

[14/06/2026 18:19] Keiko Fujimori rejeita recontagem de votos e anuncia que sairá do país na reta final da apuração - Gazeta do Povo

[13/06/2026 20:13] Quem foi Niño Guerrero, líder do Tren de Aragua com atuação no Brasil - CNN Brasil

[CVE-2026-2517] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A security flaw has been discovered in Open5GS up to 2.7.6. This vulnerability affects the function ogs_gtp2_parse_tft in the library lib/gtp/v2/types.c of the component SMF. Performing a manipulation of the argument pf[0].content.length results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2019-25368] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDrive_GDriveEmail, GDrive_GDriveFolderID, GDrive_GDriveBackupCount, Nextcloud_url, Nextcloud_user, Nextcloud_password, Nextcloud_password_encryption, and Nextcloud_backupdir. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated administrator sessions.

[CVE-2019-25369] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. Attackers can submit POST requests with script payloads that are stored and executed in the context of authenticated user sessions when the page is viewed.

[CVE-2019-25370] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. Attackers can send POST requests to interfaces_vlan_edit.php with script payloads in the tag, descr, or vlanif parameters to execute arbitrary JavaScript in users' browsers.

[CVE-2019-25371] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted POST requests to the diag_ping.php endpoint with script payloads in the host parameter to execute arbitrary JavaScript in users' browsers.

[CVE-2019-25372] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted payloads through POST requests to diag_traceroute.php to execute arbitrary JavaScript in the context of a user's browser session.

[CVE-2019-25373] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter. Attackers can send POST requests to firewall_rules_edit.php with script payloads in the category field to execute arbitrary JavaScript in the browsers of other users accessing firewall rule pages.

[CVE-2019-25374] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. Attackers can craft POST requests with JavaScript payloads in the passthrough_networks parameter to execute arbitrary code in users' browsers.

[CVE-2019-25375] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter. Attackers can send POST requests to the monit interface with JavaScript payloads in the mailserver parameter to execute arbitrary code in users' browsers.

[CVE-2019-25376] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. Attackers can send POST requests to the proxy endpoint with JavaScript code in the ignoreLogACL parameter to execute arbitrary scripts in users' browsers.

[CVE-2019-25377] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. Attackers can craft POST requests with script payloads in the value parameter to execute JavaScript in the context of authenticated user sessions.

[CVE-2026-26366] [Modified: 26-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.

[CVE-2026-26368] [Modified: 28-02-2026] [Analyzed] [V3.1 S8.8:HIGH] eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without supplying the current password or having sufficient privileges. By sending a crafted JSON-RPC request to /jsonrpc/management, an attacker can overwrite existing credentials, resulting in direct account takeover with full administrative access and persistent privilege escalation.

[CVE-2026-26369] [Modified: 28-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.

[CVE-2026-2521] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A weakness has been identified in Open5GS up to 2.7.6. This issue affects the function sgwc_s5c_handle_create_session_response of the component SGW-C. Executing a manipulation can lead to memory corruption. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-2522] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is an unknown function of the file /src/mme/esm-build.c of the component MME. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-2523] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the file /src/smf/gn-handler.c of the component SMF. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-2524] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A flaw has been found in Open5GS 2.7.6. The impacted element is the function mme_s11_handle_create_session_response of the component MME. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-2525] [Modified: 19-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A vulnerability has been found in Free5GC up to 4.1.0. This affects an unknown function of the component PFCP UDP Endpoint. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

[CVE-2026-2526] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument SSID2G2 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.