Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

26 ℃

69%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 15:00:02

[USD] USD 75,931.76

[BRL] BRL 382,498.65 [USD] USD 75,931.76 [GBP] GBP 56,494.29 [EUR] EUR 65,327.89
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 15:10:12 up 248 days, 23:41, 4 users, load average: 0.00, 0.00, 0.00

[26/05/2026 07:13] Operação da PF contra Cláudio Castro mira transferências de R$ 3 bilhões em investimentos do Rioprevidência - O Globo

[26/05/2026 12:54] Atlas da Violência: Veja municípios mais e menos violentos do Brasil - CNN Brasil

[26/05/2026 12:47] Moraes pede parecer da PGR para incluir Flávio e Jair Bolsonaro em investigação - Gazeta do Povo

[26/05/2026 02:00] O acordo para aprovar o fim da escala 6x1 na Câmara: o que falta definir na proposta - BBC

[26/05/2026 10:43] PF prende Gerson Palermo, chefe do PCC que estava foragido - CNN Brasil

[26/05/2026 12:34] Caso Henry Borel: advogado renuncia à defesa de Jairinho em solidariedade a colega que sofreu infarto durante preparação do júri - O Globo

[26/05/2026 11:00] Brasil alcança maior índice de desenvolvimento humano da história - Agência Brasil

[26/05/2026 11:30] Agenda de Trump não confirma encontro com Flávio Bolsonaro nos EUA - Correio Braziliense

[26/05/2026 10:53] Mulher que desapareceu após passeio de moto aquática é resgatada com vida em alto-mar no litoral de SP - G1

[26/05/2026 05:05] Quem é Aury Lopes Jr., advogado de Deolane Bezerra conhecido por trabalhos acadêmicos - O Globo

[CVE-2025-50537] [Modified: 04-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Stack overflow vulnerability in eslint before 9.26.0 when serializing objects with circular references in eslint/lib/shared/serialization.js. The exploit is triggered via the RuleTester.run() method, which validates test cases and checks for duplicates. During validation, the internal function checkDuplicateTestCase() is called, which in turn uses the isSerializable() function for serialization checks. When a circular reference object is passed in, isSerializable() enters infinite recursion, ultimately causing a stack overflow.

[CVE-2025-67274] [Modified: 12-02-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints

[CVE-2025-70982] [Modified: 12-02-2026] [Analyzed] [V3.1 S9.9:CRITICAL] Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.

[CVE-2025-57783] [Modified: 18-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources managed by Hiawatha webserver.

[CVE-2025-57784] [Modified: 18-02-2026] [Analyzed] [V3.1 S3.3:LOW] Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to access the management client.

[CVE-2025-57785] [Modified: 13-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrupt data which may lead to arbitrary code execution.

[CVE-2026-0925] [Modified: 09-03-2026] [Analyzed] [V3.1 S2.7:LOW] Tanium addressed an improper input validation vulnerability in Discover.

[CVE-2026-1224] [Modified: 09-03-2026] [Analyzed] [V3.1 S4.9:MEDIUM] Tanium addressed an uncontrolled resource consumption vulnerability in Discover.

[CVE-2026-1446] [Modified: 13-02-2026] [Analyzed] [V3.1 S5.0:MEDIUM] There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier. ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are required beyond standard local user access. A local attacker can supply malicious strings that may be rendered and executed when a specific dialog within ArcGIS Pro is opened. This issue is fixed in ArcGIS Pro version 3.6.1.

[CVE-2026-21509] [Modified: 11-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

[CVE-2026-24428] [Modified: 29-01-2026] [Analyzed] [V3.1 S8.8:HIGH] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.

[CVE-2026-24429] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these default credentials to gain authenticated access to the management interface.

[CVE-2026-24430] [Modified: 28-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.

[CVE-2026-24431] [Modified: 28-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials.

[CVE-2026-24432] [Modified: 28-01-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints, including those used to change administrator account credentials. As a result, an attacker can craft malicious requests that, when triggered by an authenticated user’s browser, modify administrative passwords and other configuration settings.

[CVE-2026-24433] [Modified: 28-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users access the affected management pages.

[CVE-2026-24435] [Modified: 02-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative endpoints. The device sets Access-Control-Allow-Origin: * in combination with Access-Control-Allow-Credentials: true, allowing attacker-controlled origins to issue credentialed cross-origin requests.

[CVE-2026-24436] [Modified: 28-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.

[CVE-2026-24437] [Modified: 28-01-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directives. As a result, browsers may store credential-bearing responses locally, exposing them to subsequent unauthorized access.

[CVE-2026-24439] [Modified: 28-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As a result, browsers that perform MIME sniffing may incorrectly interpret attacker-influenced responses as executable script.