Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

15 ℃

86%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 20:00:02

[USD] USD 73,360.03

[BRL] BRL 370,739.58 [USD] USD 73,360.03 [GBP] GBP 54,572.97 [EUR] EUR 62,967.26
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 20:25:07 up 251 days, 4:56, 4 users, load average: 0.05, 0.03, 0.00

[28/05/2026 19:04] Trump decide classificar PCC e Comando Vermelho como terroristas - CartaCapital

[28/05/2026 16:09] Juíza interrompe sessão do caso Henry após suspeita de que advogada observava anotações dos jurados - O GLOBO

[28/05/2026 10:34] Carne folheada a ouro: jantar de luxo pago por Vorcaro a Castro entra na mira da PF - Correio Braziliense

[28/05/2026 16:56] Fim da escala 6x1 com transição curta 'é inviável', diz dono de pizzaria: 'Como eu faço para ter um novo chef em 60 dias?' - BBC

[28/05/2026 08:52] Mário Frias e Karina da Gama teriam oferecido até R$ 500 mil pela história de Bolsonaro - Agência Pública

[28/05/2026 17:37] 'Farra do uísque' paga por Vorcaro reuniu Castro, Motta, Ciro Nogueira e cotados para presidência da Câmara - O GLOBO

[28/05/2026 07:01] Lula vence todos os oponentes no 2º turno, diz Meio/Ideia - Poder360

[28/05/2026 08:47] Bancos paralelos: fintechs ligadas ao PCC movimentaram R$ 26 bilhões - CNN Brasil

[28/05/2026 13:19] Datafolha em Pernambuco: Raquel Lyra tem 48% e João Campos, 43% no 1º turno para o governo do estado - G1

[28/05/2026 14:17] Mulher é presa por gravar torturas a animais e vender nas redes em SP - CNN Brasil

[CVE-2023-37525] [Modified: 12-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.

[CVE-2025-13979] [Modified: 12-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2.

[CVE-2025-13980] [Modified: 12-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0 before 1.6.4.

[CVE-2025-13981] [Modified: 19-02-2026] [Analyzed] [V3.1 S4.4:MEDIUM] Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4.

[CVE-2025-13982] [Modified: 19-02-2026] [Analyzed] [V3.1 S8.1:HIGH] Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.

[CVE-2025-13983] [Modified: 03-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.

[CVE-2025-13984] [Modified: 06-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

[CVE-2025-13985] [Modified: 06-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.

[CVE-2025-13986] [Modified: 06-02-2026] [Analyzed] [V3.1 S4.2:MEDIUM] Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.

[CVE-2025-14472] [Modified: 06-02-2026] [Analyzed] [V3.1 S8.1:HIGH] Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3.

[CVE-2025-14840] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.

[CVE-2025-46691] [Modified: 09-03-2026] [Analyzed] [V3.1 S7.8:HIGH] Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

[CVE-2025-61726] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.5:HIGH] The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

[CVE-2025-61728] [Modified: 06-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

[CVE-2025-61730] [Modified: 03-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

[CVE-2025-61731] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

[CVE-2025-68119] [Modified: 06-02-2026] [Analyzed] [V3.1 S7.0:HIGH] Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.

[CVE-2025-68662] [Modified: 30-01-2026] [Analyzed] [V3.1 S7.6:HIGH] Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.

[CVE-2025-68666] [Modified: 30-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with moderation privileges even though moderators should not have access to the archives. Private topic/post content made by the users are leaked through the archives leading to a breach of confidentiality. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. To work around this problem, a site admin can temporarily revoke the moderation role from all moderators until the Discourse instance has been upgraded to a version that has been patched.

[CVE-2025-68933] [Modified: 30-01-2026] [Analyzed] [V3.1 S6.9:MEDIUM] Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_change_post_ownership` setting enabled can change ownership of posts in private messages and restricted categories they cannot access, then export their data to view the content. This is a broken access control vulnerability affecting sites that grant moderators post ownership transfer permissions. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The patch adds visibility checks for both the topic and posts before allowing ownership transfer. As a workaround, disable the `moderators_change_post_ownership` site setting to prevent non-admin moderators from using the post ownership transfer feature.