Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens dispersas

16 ℃

96%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 23:00:01

[USD] USD 79,129.73

[BRL] BRL 402,107.23 [USD] USD 79,129.73 [GBP] GBP 59,371.04 [EUR] EUR 68,083.22
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 23:28:37 up 238 days, 7:59, 3 users, load average: 0.00, 0.00, 0.00

[15/05/2026 19:21] Eduardo diz que custeou início de filme com R$ 350 mil, mas teve reembolso - CNN Brasil

[15/05/2026 14:48] Suspeito de elo com PCC e maior sonegador do Brasil: quem é o empresário Ricardo Magro, que está na lista vermelha da Interpol? - BBC

[15/05/2026 18:07] PGR denuncia ao STJ Romeu Zema por calúnia contra ministro Gilmar Mendes - G1

[15/05/2026 17:30] Menina de 8 anos é atacada por onça-parda em trilha na Chapada dos Veadeiros, em Goiás - Folha de S.Paulo

[15/05/2026 09:29] Lula chamou Magro de 'grande chefe do crime organizado' e disse ter pedido prisão a Trump - O Globo

[15/05/2026 17:31] Gilmar diz que Fachin "não sabe perder" e obstrui julgamentos - Poder360

[15/05/2026 12:55] Flávio diz que Zema se ‘precipitou’ com críticas sobre vazamento de áudio - Revista Oeste

[15/05/2026 18:00] José Dirceu é diagnosticado com linfoma; entenda tratamento da doença - CNN Brasil

[15/05/2026 18:52] PEC do fim da escala 6x1 muda a Constituição, reduz jornada para 40 horas e prevê punição a empresas - Revista Oeste

[15/05/2026 17:41] Investigação de Lulinha: PF revela por que transferiu delegado que pediu quebra de sigilo - ND Mais

[CVE-2025-68671] [Modified: 25-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.

[CVE-2026-1008] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.6:HIGH] A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.

[CVE-2026-1009] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.0:CRITICAL] A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.

[CVE-2026-1010] [Modified: 23-01-2026] [Analyzed] [V3.1 S8.0:HIGH] A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.

[CVE-2026-22045] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.9:MEDIUM] Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7.

[CVE-2026-22863] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.

[CVE-2026-22864] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.1:HIGH] Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.

[CVE-2020-36926] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique identifiers.

[CVE-2020-36927] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe' to inject malicious executables and escalate privileges.

[CVE-2020-36928] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Brother\BRAgent\ to inject and execute malicious code with elevated system permissions.

[CVE-2020-36929] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted file paths in BrAuSvc and BRPA_Agent services to inject malicious executables and escalate privileges on the system.

[CVE-2020-36930] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\SysGauge Server\bin\sysgaus.exe' to inject malicious executables and escalate privileges.

[CVE-2021-47780] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the improperly configured service path to inject malicious executables that will be run with LocalSystem permissions during service startup.

[CVE-2021-47783] [Modified: 09-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.

[CVE-2021-47785] [Modified: 09-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. Attackers can craft a malicious payload to overwrite SEH handlers and execute a bind shell on port 3110 by exploiting improper input validation.

[CVE-2021-47786] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests. Attackers can send a crafted 2000-byte buffer with specific byte patterns to the REDRAGON_MOUSE device to crash the kernel driver.

[CVE-2021-47787] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious executables in specific unquoted path segments to potentially gain SYSTEM-level access by exploiting the service path configuration.

[CVE-2021-47788] [Modified: 30-01-2026] [Analyzed] [V3.1 S8.8:HIGH] WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.

[CVE-2021-47789] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending oversized input. Attackers can exploit the driver by sending a 2000-byte buffer through DeviceIoControl to trigger a kernel-level system crash.

[CVE-2021-47790] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Active WebCam 11.5 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the misconfigured service path by placing malicious executables in specific directory locations to gain administrative access.