Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

21 ℃

81%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 20:00:02

[USD] USD 91,219.91

[BRL] BRL 486,819.77 [USD] USD 91,219.91 [GBP] GBP 68,944.46 [EUR] EUR 78,663.03
Price index provided by blockchain.info.
Disclosure of the details of a bug on 32-bit systems which may, in a rare edge case, cause the node to crash when receiving a pathological block. This bug would be extremely hard to exploit. A fix was released on October 10th 2025 in Bitcoin Core v30.0.
This issue is considered Low severity.

Details
Before writing a block to disk, Bitcoin Core checks that its size is within a normal range. This check would overflow on 32-bit systems for blocks over 1GB, and make the node crash when writing it to disk. Such a block cannot be sent using the BLOCK message, but could in theory be sent as a compact block if the victim node has a non-default large mempool which already contains 1GB of transactions. This would require the victim to have set their -maxmempool option to a value greater than 3GB, while 32-bit systems may have at most 4GiB of memory.
This issue was indirectly prevented by capping the maximum value of the -maxmempool setting on 32-bit systems.

Attribution
Pieter Wuille discovered this bug and disclosed it responsibly.
Antoine Poinsot proposed and implemented a covert mitigation.

Timeline
- 2025-04-24 - Pieter Wuille reports the issue
- 2025-05-16 - Antoine Poinsot opens PR #32530 with a covert fix
- 2025-06-26 - PR #32530 is merged into master
- 2025-09-04 - Version 29.1 is released with the fix
- 2025-10-10 - Version 30.0 is released with the fix
- 2025-10-24 - Public Disclosure

dog - 20:04:32 up 72 days, 4:35, 7 users, load average: 0.00, 0.00, 0.00

[30/11/2025 18:30] Gleisi rebate Alcolumbre após fala sobre cargos e emendas: “insinuações” - CNN Brasil

[30/11/2025 16:57] A situação dos voos na Venezuela após anúncios de Trump sobre o fechamento do espaço aéreo do país - G1

[30/11/2025 13:26] Homem é morto por leoa após invadir recinto dos felinos em zoo na PB Vídeo sensível - Metrópoles

[30/11/2025 12:56] Soltura de Vorcaro é cuspe na cara dos brasileiros, diz Sóstenes - Poder360

[30/11/2025 14:22] Heleno se confundiu: laudo de Alzheimer é de 2025, explica defesa - Gazeta do Povo

[30/11/2025 13:57] Tema da redação do Enem 2025 na Grande Belém é 'A valorização dos trabalhadores rurais no Brasil' - G1

[30/11/2025 16:56] Zema reproduz meme com rojão para ironizar PT, é cobrado sobre lei e alega edição de vídeo; veja - O Globo

[30/11/2025 12:32] Vídeo: homem atropela e arrasta mulher pela Marginal Tietê (SP) - CNN Brasil

[30/11/2025 15:24] Machosfera: entenda termo usado na redação da Unicamp - CNN Brasil

[30/11/2025 13:35] "Se tivessem dado golpe, eu estava na prisão", diz Cármen Lúcia - CNN Brasil

[CVE-2025-8493] [Modified: 05-08-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_student_query.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8494] [Modified: 05-08-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /admin/delete_student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-54351] [Modified: 17-10-2025] [Analyzed] [V3.1 S8.9:HIGH] In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

[CVE-2025-8495] [Modified: 08-08-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /admin/edit_admin_query.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8496] [Modified: 08-08-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /viewform.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8497] [Modified: 29-09-2025] [Analyzed] [V3.1 S7.3:HIGH] A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This manipulation of the argument Search causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

[CVE-2025-8498] [Modified: 29-09-2025] [Analyzed] [V3.1 S7.3:HIGH] A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /cart/index.php. Such manipulation of the argument uname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

[CVE-2025-8499] [Modified: 05-08-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cusfindambulence2.php. The manipulation of the argument Search leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8500] [Modified: 23-10-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insert-and-view/action.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8501] [Modified: 23-10-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown function of the file /insert-and-view/action.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8502] [Modified: 05-08-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown functionality of the file /changepass.php. The manipulation of the argument ups leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8503] [Modified: 05-08-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Affected by this issue is some unknown functionality of the file /adaddmed.php. The manipulation of the argument mname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8504] [Modified: 08-08-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

[CVE-2025-8507] [Modified: 12-08-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-8508] [Modified: 12-08-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argument titulo_avaliacao/descricao leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-8509] [Modified: 12-08-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-8510] [Modified: 12-08-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.

[CVE-2025-8511] [Modified: 11-09-2025] [Analyzed] [V3.1 S3.5:LOW] A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ of the component Observações. The manipulation of the argument Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-20696] [Modified: 18-08-2025] [Analyzed] [V3.1 S6.8:MEDIUM] In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801.

[CVE-2025-20697] [Modified: 18-08-2025] [Analyzed] [V3.1 S6.7:MEDIUM] In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795.