Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

18 ℃

93%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 23:00:02

[USD] USD 60,117.55

[BRL] BRL 311,775.65 [USD] USD 60,117.55 [GBP] GBP 45,540.13 [EUR] EUR 52,783.33
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 23:21:13 up 281 days, 7:52, 7 users, load average: 0.00, 0.00, 0.00

[27/06/2026 22:27] Redes sociais se revoltam com gol anulado da Colômbia: "Impossível" - GE

[27/06/2026 15:46] Mortos por terremotos na Venezuela passam de 1.400 enquanto equipes de resgate correm para encontrar sobreviventes - BBC

[27/06/2026 20:38] Trump anuncia retomada de ataques no Oriente Médio e ameaça ‘existência’ do Irã - Estadão

[27/06/2026 21:33] Moto usada em atentado contra tenente da Rota, irmão de Eloá, é encontrada - UOL Notícias

[27/06/2026 18:12] Polícia Civil identifica homens mortos em frente a condomínio no Recreio - O Globo

[27/06/2026 17:04] Fux vota e STF forma maioria para liberar parte dos ‘penduricalhos’ a juízes e membros do MP - Estadão

[27/06/2026 12:17] Alcides Fernandes chama de 'infeliz' vídeo publicado por Michelle e diz que Bolsonaro autorizou apoio a Ciro no Ceará - G1

[27/06/2026 15:56] PF indicia diretor-geral da ANM em inquérito que investigou esquema de mineração ilegal - O Globo

[27/06/2026 14:09] Neonazista brasileiro condenado por assassinato é preso na Itália - CartaCapital

[27/06/2026 10:03] Em carta, Marco Rubio agradece a Flávio Bolsonaro por colocar 'equipe de transição' à disposição dos EUA caso seja eleito - G1

[CVE-2026-28423] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.8:MEDIUM] Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server. This has been fixed in 5.73.11 and 6.4.0.

[CVE-2026-28424] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

[CVE-2026-28426] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.7:HIGH] Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

[CVE-2026-28515] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.

[CVE-2026-28516] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

[CVE-2026-2844] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.

[CVE-2026-3010] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2.

[CVE-2026-28554] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.

[CVE-2026-28555] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

[CVE-2026-28556] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.

[CVE-2026-28557] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

[CVE-2026-28558] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.4:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.

[CVE-2026-28559] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

[CVE-2026-28560] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.

[CVE-2026-28561] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.

[CVE-2026-28562] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

[CVE-2026-3376] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-3377] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

[CVE-2026-3378] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

[CVE-2026-3379] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.