Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
chuva fraca

15 ℃

98%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 18:30:01

[USD] USD 62,459.89

[BRL] BRL 324,666.50 [USD] USD 62,459.89 [GBP] GBP 47,303.75 [EUR] EUR 54,859.15
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 18:50:39 up 277 days, 3:21, 6 users, load average: 0.00, 0.00, 0.00

[23/06/2026 14:26] Resultado oficial do 2º turno da Colômbia é quase idêntico à contagem inicial que deu vitória a Espriella, diz órgão eleitoral - G1

[23/06/2026 11:24] Flávio Bolsonaro pede espaço em audiência nos EUA para falar de tarifas - Correio Braziliense

[23/06/2026 11:09] Traficantes do Dona Marta anunciavam drogas como 'especiarias' em rede social; embalagens eram inspiradas em filmes e desenhos - O Globo

[23/06/2026 15:39] Quais as escolas do Rio com as maiores notas do Enem 2025? Confira ranking - O Globo

[23/06/2026 14:41] Digimais: banco de Edir Macedo, da Igreja Universal, é alvo de operação da PF contra fraudes no sistema financeiro - BBC

[23/06/2026 13:44] Datafolha: 59% dizem apoiar classificação de PCC e CV como terroristas; 74% são contra ação dos EUA sem autorização do Brasil - G1

[23/06/2026 09:00] Lula inaugura primeira etapa das obras da nova Serra das Araras na Via Dutra - G1

[23/06/2026 15:24] Justiça dos EUA nega, por ora, pedido de revelia contra Moraes - CNN Brasil

[23/06/2026 12:08] Programa que busca reduzir roubo de celular preocupa governo Lula por efeito eleitoral negativo de devolução de aparelhos - O Globo

[23/06/2026 14:39] Bolsonaro depôs por 5 minutos e repetiu que queria 'consertar' arma apreendida em blitz, diz defesa - G1

[CVE-2025-61146] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.0:MEDIUM] saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.

[CVE-2025-61147] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.2:MEDIUM] strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table().

[CVE-2025-63945] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.4:HIGH] A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.

[CVE-2025-63946] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.4:HIGH] A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.

[CVE-2025-67733] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.5:HIGH] Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.

[CVE-2025-70329] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.0:HIGH] TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to the CsteSystem function without adequate validation or filtering. This allows an authenticated attacker to execute arbitrary shell commands with root privileges by injecting shell metacharacters into the affected parameters.

[CVE-2026-21863] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processing code does not validate that a clusterbus ping extension packet is located within buffer of the clusterbus packet before attempting to read it. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. As an additional mitigation, don't expose the cluster bus connection directly to end users, and protect the connection with its own network ACLs.

[CVE-2026-27623] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the system to abort by triggering an assertion. When processing incoming requests, the Valkey system does not properly reset the networking state after processing an empty request. A malicious actor can then send a request that the server incorrectly identifies as breaking server side invariants, which results in the server shutting down. Version 9.0.3 fixes the issue. As an additional mitigation, properly isolate Valkey deployments so that only trusted users have access.

[CVE-2025-68930] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.1:HIGH] Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/socket` endpoint. The application fails to validate the `Origin` header during the WebSocket handshake. This allows a remote attacker to bypass the Same Origin Policy (SOP) and establish a full-duplex WebSocket connection using a legitimate user's credentials (JSESSIONID). As of time of publication, it is unclear whether a fix is available.

[CVE-2025-70327] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a hyphen (-). This allows remote authenticated attackers to inject arbitrary command-line options into the ping utility, potentially leading to a Denial of Service (DoS) by causing excessive resource consumption or prolonged execution.

[CVE-2025-70328] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The host_time parameter is retrieved via sub_40C404 and passed to a date -s shell command through CsteSystem. While the first two tokens of the input are validated, the remainder of the string is not sanitized, allowing authenticated attackers to execute arbitrary shell commands via shell metacharacters.

[CVE-2026-23521] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device `uniqueId` to an absolute path. When uploading a device image, Traccar uses that `uniqueId` to build the filesystem path without enforcing that the resolved path stays under the media root. This allows writing files outside the media directory. As of time of publication, it is unclear whether a fix is available.

[CVE-2026-25648] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.7:HIGH] Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. The application accepts SVG file uploads without sanitization and serves them with the `image/svg+xml` Content-Type, allowing embedded JavaScript to execute when victims view the image. As of time of publication, it is unclear whether a fix is available.

[CVE-2026-3025] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] A flaw has been found in ShuoRen Smart Heating Integrated Management Platform 1.0.0. Affected by this vulnerability is an unknown functionality of the file /MP/Service/Webservice/ExampleNodeService.asmx. Executing a manipulation of the argument File can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-3026] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the file /plug-in/ueditor/jsp/getRemoteImage.jsp of the component UEditor. The manipulation of the argument upfile leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-3027] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the component UEditor. The manipulation of the argument myEditor results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-69208] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Versions prior to 1.4.1 contain an Improper Error Handling vulnerability with Information Exposure. All deployments of free5GC using the Nnef_PfdManagement service may be affected. The NEF component reliably leaks internal parsing errors (e.g., invalid character 'n' after top-level value) to remote clients. This can aid attackers in fingerprinting server software and logic flows. Version 1.4.1 fixes the issue. There is no direct workaround at the application level. The recommended mitigation is to apply the provided patch.

[CVE-2025-69232] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to Denial of Service. Remote attackers can disrupt core network functionality by sending a malformed PFCP Association Setup Request. The UPF incorrectly accepts it, entering an inconsistent state that causes subsequent legitimate requests to trigger SMF reconnection loops and service degradation. All deployments of free5GC using the UPF and SMF components may be affected. As of time of publication, a fix is in development but not yet available. No direct workaround is available at the application level. Applying the official patch, once released, is recommended.

[CVE-2025-69247] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based Buffer Overflow (CWE-122) vulnerability leading to Denial of Service. Remote attackers can crash the UPF network element by sending a specially crafted PFCP Session Modification Request with an invalid SDF Filter length field. This causes a heap buffer overflow, resulting in complete service disruption for all connected UEs and potential cascading failures affecting the SMF. All deployments of free5GC using the UPF component may be affected. Version 1.2.8 of go-upf contains a fix.

[CVE-2025-69248] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of free5GC's AMF service have a Buffer Overflow vulnerability leading to Denial of Service. Remote unauthenticated attackers can crash the AMF service by sending a specially crafted NAS Registration Request with a malformed 5GS Mobile Identity, causing complete denial of service for the 5G core network. All deployments of free5GC using the AMF component may be affected. Pull request 43 of the free5gc/nas repo contains a fix. No direct workaround is available at the application level. Applying the official patch is recommended.