Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

14 ℃

95%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 02:30:01

[USD] USD 66,948.19

[BRL] BRL 336,193.73 [USD] USD 66,948.19 [GBP] GBP 49,735.81 [EUR] EUR 57,589.77
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 02:43:00 up 256 days, 11:14, 5 users, load average: 0.00, 0.00, 0.00

[02/06/2026 21:56] Flávio diz que novo tarifaço dos EUA é contra Lula e não contra empresas - CNN Brasil

[02/06/2026 16:37] ‘Uma mãe não mata seu filho’, defende-se Monique Medeiros em julgamento pela morte de Henry Borel - O Globo

[02/06/2026 20:04] TSE rejeita recursos de Castro e mantém inelegibilidade de ex-governador - CNN Brasil

[02/06/2026 16:36] Leonardo Sakamoto: Elogio de Trump a Flávio Bolsonaro na hora errada vira atestado de traição - UOL Notícias

[02/06/2026 13:51] Flávio Bolsonaro pede para "dar um gás" a interlocutor de Vorcaro, que prioriza pagamentos ao "filme" do clã, revela Intercept - Revista Fórum

[02/06/2026 15:27] Marco Rubio coloca Brasil fora do grupo ‘países amigáveis’ aos EUA e cita eleições nacionais - CartaCapital

[02/06/2026 20:01] Senado aprova projeto que dificulta o aborto legal em crianças - CartaCapital

[02/06/2026 18:27] PEC da escala 6x1 não irá diretamente para o Plenário do Senado, diz Davi — Senado Notícias - Senado Federal

[02/06/2026 20:31] "Estávamos tomando água de coco", diz primo de jovem atacada por tubarão - CNN Brasil

[02/06/2026 21:05] Governo do Distrito Federal contratou por R$ 5 milhões ONG ligada a produtora de 'Dark Horse' - O Globo

[CVE-2025-12774] [Modified: 03-03-2026] [Analyzed] [V3.1 S7.5:HIGH] A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries in the SANnav support save file. An attacker with access to Brocade SANnav supportsave file, could open the file and then obtain sensitive information such as details of database tables and encrypted passwords.

[CVE-2025-58379] [Modified: 06-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expose higher privilege sensitive information by a lower privileged user.

[CVE-2025-58382] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands as root using “supportsave”, “seccertmgmt”, “configupload” command.

[CVE-2025-58383] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.2:HIGH] A vulnerability in Brocade Fabric OS versions before 9.2.1c2 could allow an administrator-level user to execute the bind command, to escalate privileges and bypass security controls allowing the execution of arbitrary commands.

[CVE-2025-61651] [Modified: 09-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js. This issue affects CheckUser: from * before 1.44.1.

[CVE-2025-61655] [Modified: 09-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

[CVE-2025-61656] [Modified: 09-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

[CVE-2025-61658] [Modified: 14-04-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php. This issue affects CheckUser: from * before 1.43.4, 1.44.1.

[CVE-2025-67475] [Modified: 09-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

[CVE-2025-67476] [Modified: 14-04-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

[CVE-2025-67477] [Modified: 09-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

[CVE-2025-67478] [Modified: 14-04-2026] [Analyzed] [V3.1 S8.8:HIGH] Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.

[CVE-2025-67480] [Modified: 14-04-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

[CVE-2025-67481] [Modified: 09-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

[CVE-2025-67483] [Modified: 09-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

[CVE-2025-67484] [Modified: 14-04-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

[CVE-2026-24932] [Modified: 19-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication to perform a Man-in-the-Middle (MitM) attack, which may obtain the sensitive information of DDNS updating process, including the user's account email, MD5 hashed password, and device serial number.This issue affects ADM: from 4.1.0 through 4.3.3.ROF1, from 5.0.0 through 5.1.1.RCI1.

[CVE-2026-24933] [Modified: 19-02-2026] [Analyzed] [V3.1 S5.9:MEDIUM] The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulnerability allows an unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to intercept the cleartext communication, potentially leading to the exposure of sensitive user information, including account emails, MD5 hashed passwords, and device serial numbers. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

[CVE-2026-24934] [Modified: 19-02-2026] [Analyzed] [V3.1 S3.7:LOW] The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.

[CVE-2026-24935] [Modified: 19-02-2026] [Analyzed] [V3.1 S5.6:MEDIUM] A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a proxy between the user and the device services. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.