Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

23 ℃

68%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 09:30:01

[USD] USD 80,389.51

[BRL] BRL 395,050.12 [USD] USD 80,389.51 [GBP] GBP 58,962.57 [EUR] EUR 68,193.13
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 09:51:09 up 231 days, 18:22, 4 users, load average: 0.00, 0.00, 0.00

[08/05/2026 19:42] Moraes é sorteado relator de ações que questionam Lei da Dosimetria no STF e dá cinco dias para Congresso se manifestar - O Globo

[08/05/2026 21:40] Ex-presidente do BRB chega na Papudinha após decisão de Mendonça - Correio Braziliense

[08/05/2026 20:44] Defesa de Jair Bolsonaro pede anulação da condenação no STF - Estado de Minas

[08/05/2026 12:20] Rogério Correia cobra Nikolas sobre ligação entre Ciro e Vorcaro - Poder360

[09/05/2026 03:37] OVNIs: Astronautas viram luz vermelha misteriosa no espaço; veja relato - CNN Brasil

[07/05/2026 20:07] Trump suspendeu escolta de navios em Ormuz após Arábia Saudita barrar uso de base - InfoMoney

[09/05/2026 06:59] Flávio Bolsonaro explica chapa em SC e vê Senado “mais propício” a impeachment no STF em 2027 - NSC Total

[08/05/2026 16:45] Trump respeita quem se mostra firme e altivo como Lula, diz ex-embaixador nos EUA - CartaCapital

[08/05/2026 20:11] Moradora de prédio atingido por avião em BH denuncia assédio - Estado de Minas

[08/05/2026 14:15] Primeira onda de frio do ano atinge 12 estados e traz temperaturas abaixo de 0°C; veja onde - ND Mais

[CVE-2025-10569] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to create a denial of service condition by providing crafted responses to external API calls.

[CVE-2025-11246] [Modified: 22-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner associations.

[CVE-2025-13761] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.0:HIGH] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.

[CVE-2025-13772] [Modified: 22-01-2026] [Analyzed] [V3.1 S7.1:HIGH] GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.

[CVE-2025-13781] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations.

[CVE-2025-3950] [Modified: 21-01-2026] [Analyzed] [V3.1 S3.5:LOW] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak certain information by referencing specially crafted images that bypass asset proxy protection.

[CVE-2025-64090] [Modified: 12-02-2026] [Analyzed] [V3.1 S10.0:CRITICAL] This vulnerability allows authenticated attackers to execute commands via the hostname of the device.

[CVE-2025-64091] [Modified: 12-02-2026] [Analyzed] [V3.1 S8.6:HIGH] This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.

[CVE-2025-64092] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.5:HIGH] This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.

[CVE-2025-64093] [Modified: 10-02-2026] [Analyzed] [V3.1 S10.0:CRITICAL] Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device.

[CVE-2025-9222] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.7:HIGH] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.

[CVE-2025-66049] [Modified: 14-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.

[CVE-2025-66050] [Modified: 14-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.

[CVE-2025-66051] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Vivotek IP7137 camera with firmware version 0200a is vulnerable to path traversal. It is possible for an authenticated attacker to access resources beyond webroot directory using a direct HTTP request. Due to CVE-2025-66050, a password for administration panel is not set by default. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.

[CVE-2025-66052] [Modified: 14-01-2026] [Analyzed] [V3.1 S7.2:HIGH] Vivotek IP7137 camera with firmware version 0200a is vulnerable to command injection. Parameter "system_ntpIt" used by "/cgi-bin/admin/setparam.cgi" endpoint is not sanitized properly, allowing a user with administrative privileges to perform an attack. Due to CVE-2025-66050, administrative access is not protected by default, The vendor has not replied to the CNA Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected to be released.

[CVE-2025-14598] [Modified: 10-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database.

[CVE-2025-15492] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/mapping/GroupMemberMapper.xml. Performing a manipulation of the argument searchWord results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-46643] [Modified: 05-02-2026] [Analyzed] [V3.1 S2.3:LOW] Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain a Heap-based Buffer Overflow vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.

[CVE-2025-46644] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.0:MEDIUM] Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS2023 release versions 7.10.1.0 through 7.10.1.70, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

[CVE-2025-46676] [Modified: 05-02-2026] [Analyzed] [V3.1 S2.7:LOW] Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.