Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens dispersas

17 ℃

92%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 18:00:02

[USD] USD 63,343.11

[BRL] BRL 323,943.00 [USD] USD 63,343.11 [GBP] GBP 47,219.69 [EUR] EUR 54,707.61
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 18:17:00 up 265 days, 2:48, 5 users, load average: 0.01, 0.01, 0.00

[11/06/2026 12:21] Torcedores começam a chegar ao entorno do Estádio Azteca, para abertura da Copa do Mundo 2026 - O Globo

[11/06/2026 14:47] Trump diz que pontos finais de acordo entre EUA e Irã foram aprovados - CNN Brasil

[11/06/2026 11:51] Leonardo Sakamoto: Senado atrasa fim da 6x1 enquanto aprova pauta-bomba dos patrões - UOL Notícias

[11/06/2026 04:42] Criadora da Lei Maria da Penha critica 'perdão' à mãe de Henry Borel: 'Nada justifica, mulheres não querem bondade, querem equidade' - BBC

[11/06/2026 12:57] El Niño chegou e pode ser "muito forte", diz agência dos EUA - CNN Brasil

[11/06/2026 00:03] Congresso não pode criar despesas a Estados e municípios, diz Gilmar - Poder360

[11/06/2026 13:21] Desmatamento na Amazônia cai 61,4% em maio de 2026 - Agência Brasil

[11/06/2026 07:55] A vantagem de Lula na disputa com Flávio Bolsonaro em Pernambuco, segundo pesquisa - CartaCapital

[10/06/2026 08:37] O que está por trás da nova tarifa dos EUA sobre o Brasil? - O Presente Rural

[11/06/2026 13:05] Novo ciclone em cinco dias coloca SC em perigo para chuva de até 100 mm em 24h - NSC Total

[CVE-2025-69874] [Modified: 03-04-2026] [Analyzed] [V3.1 S9.8:CRITICAL] nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.

[CVE-2025-70029] [Modified: 01-04-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTP request options

[CVE-2025-70083] [Modified: 17-02-2026] [Analyzed] [V3.1 S7.8:HIGH] An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The program copies DirName into the local buffer DirWithSep using strcpy. The size of this buffer is OS_MAX_PATH_LEN. If the length of DirName is greater than or equal to OS_MAX_PATH_LEN, a stack buffer overflow occurs, overwriting adjacent stack memory. The path length check (FileUtil_AppendPathSep) is performed after the strcpy operation, meaning the validation occurs too late and cannot prevent the overflow.

[CVE-2025-70084] [Modified: 17-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via crafted value to the FileUtil_GetFileInfo function.

[CVE-2025-70085] [Modified: 17-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes. The code uses sprintf to format two filenames (Source1Filename and the string returned by FileUtil_FileStateStr) into this buffer without any length checking and without using bounded format specifiers such as %.*s. If the filename length approaches OS_MAX_PATH_LEN (commonly 64-256 bytes), the combined formatted string together with constant text can exceed 256 bytes, resulting in a stack buffer overflow. Such unsafe sprintf calls are scattered across multiple functions in file.c, including FILE_ConcatenateCmd() and ConcatenateFiles(), all of which fail to validate the output length.

[CVE-2025-70296] [Modified: 23-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resulting in user interface redressing within the recipe view.

[CVE-2025-70297] [Modified: 23-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary web script or HTML via an uploaded SVG file that is served as image/svg+xml and rendered by a victim s browser.

[CVE-2026-2313] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

[CVE-2026-2314] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

[CVE-2026-2315] [Modified: 13-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

[CVE-2026-2316] [Modified: 13-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

[CVE-2026-2317] [Modified: 13-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

[CVE-2026-2318] [Modified: 13-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

[CVE-2026-2319] [Modified: 13-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object corruption via a malicious file. (Chromium security severity: Medium)

[CVE-2026-2320] [Modified: 13-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

[CVE-2026-2322] [Modified: 13-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

[CVE-2026-2323] [Modified: 13-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

[CVE-2024-26477] [Modified: 26-02-2026] [Analyzed] [V3.1 S7.5:HIGH] An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon_sns, export endpoints.

[CVE-2024-26478] [Modified: 26-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint.

[CVE-2024-26479] [Modified: 26-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the Command execution function.