Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

15 ℃

89%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 04:30:01

[USD] USD 63,700.37

[BRL] BRL 328,158.84 [USD] USD 63,700.37 [GBP] GBP 48,133.85 [EUR] EUR 55,505.07
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 04:44:05 up 273 days, 13:15, 5 users, load average: 0.00, 0.00, 0.00

[19/06/2026 19:31] Vorcaro marcou encontro com Jaques Wagner e disponibilizou avião para senador, indicam diálogos - Estadão

[19/06/2026 22:34] Trump chama Lula de “volátil” e diz que não pensa nele - Poder360

[20/06/2026 01:53] Misantropia: Defesa Civil emite alerta sonoro em celulares de moradores de MS - G1

[19/06/2026 22:49] Previsão indica risco de neve em forte onda de frio que vem por aí - UOL Notícias

[19/06/2026 16:08] Trump diz que pode impedir ataques de Israel ao Líbano: "Fazem o que mando" - CNN Brasil

[19/06/2026 16:27] Médicos terão de atingir nota mínima no Enamed para obter registro profissional - G1

[19/06/2026 23:30] Vini Jr. volta a brilhar, Brasil bate Haiti e lidera grupo na Copa do Mundo - CNN Brasil

[19/06/2026 16:54] Lindbergh pede pela 2ª vez que Moraes revogue domiciliar de Bolsonaro - Poder360

[19/06/2026 11:50] Governo Lula anuncia bloqueio de recursos de empresas ilegais de apostas - Correio Braziliense

[19/06/2026 11:36] Milícia exigiu taxa para liberar obras no aterro da Comlurb em Gericinó, denuncia prefeitura do Rio - O Globo

[CVE-2026-2822] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-2823] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-2824] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-52603] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

[CVE-2025-67438] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.

[CVE-2025-70831] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unauthenticated attacker to inject arbitrary operating system commands, leading to complete server compromise.

[CVE-2026-2846] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-2847] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument Isp_Name results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

[CVE-2025-15582] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-15583] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-70833] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

[CVE-2026-26093] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

[CVE-2026-26095] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26096] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26097] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26098] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26099] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26100] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26101] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26102] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.