Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

16 ℃

99%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 02:00:01

[USD] USD 78,976.68

[BRL] BRL 401,329.48 [USD] USD 78,976.68 [GBP] GBP 59,256.20 [EUR] EUR 67,951.54
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 02:03:15 up 238 days, 10:34, 3 users, load average: 0.00, 0.00, 0.00

[15/05/2026 22:59] Após negar, Eduardo confirma ter assinado contrato de gestão financeira de filme de Bolsonaro; entenda - BBC

[15/05/2026 20:30] STF determina prisão de Ricardo Magro, do Refit; empresário entra em lista da Interpol - ICL Notícias

[15/05/2026 18:07] PGR denuncia ao STJ Romeu Zema por calúnia contra ministro Gilmar Mendes - G1

[15/05/2026 20:17] Após ataque de Zema, Flávio volta a se reunir com deputada cotada para vice - CNN Brasil

[15/05/2026 23:22] Gilmar diz que Fachin "não sabe perder" e obstrui julgamentos - Poder360

[15/05/2026 18:52] PEC do fim da escala 6x1 muda a Constituição, reduz jornada para 40 horas e prevê punição a empresas - Revista Oeste

[15/05/2026 17:41] Investigação de Lulinha: PF revela por que transferiu delegado que pediu quebra de sigilo - ND Mais

[15/05/2026 16:07] José Dirceu é diagnosticado com linfoma após internação em São Paulo - Estadão

[15/05/2026 20:29] Mãe de adolescente acusado de matar Orelha desabafa: 'Que ninguém passe pelo que passamos' - ND Mais

[15/05/2026 15:50] Previsão Fim de Semana (16 e 17/05): Frentes frias e temporais em parte do Centro-Sul do país - Climatempo

[CVE-2025-61937] [Modified: 22-01-2026] [Analyzed] [V3.1 S10.0:CRITICAL] The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the model application server.

[CVE-2025-61943] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.4:HIGH] The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.

[CVE-2025-64691] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.8:HIGH] The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server.

[CVE-2025-64729] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.1:HIGH] The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity of a victim user who subsequently interacts with the project files.

[CVE-2025-64769] [Modified: 22-01-2026] [Analyzed] [V3.1 S7.1:HIGH] The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or data leakage in certain man-in-the-middle or passive inspection scenarios.

[CVE-2025-65117] [Modified: 22-01-2026] [Analyzed] [V3.1 S7.4:HIGH] The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements.

[CVE-2025-65118] [Modified: 22-01-2026] [Analyzed] [V3.1 S8.8:HIGH] The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.

[CVE-2025-62581] [Modified: 20-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Delta Electronics DIAView has multiple vulnerabilities.

[CVE-2025-62582] [Modified: 20-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Delta Electronics DIAView has multiple vulnerabilities.

[CVE-2026-1018] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Police Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing Unauthenticated remote attacker to exploit Absolute Path Traversal to download arbitrary system files.

[CVE-2026-1019] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Police Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.

[CVE-2026-1020] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Police Statistics Database System developed by Gotac has a Absolute Path Traversal vulnerability, allowing unauthenticated remote attackers to enumerate the system file directory.

[CVE-2026-1021] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Police Statistics Database System developed by Gotac has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attacker to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

[CVE-2026-1022] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

[CVE-2026-1023] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a specific functionality to query database contents.

[CVE-2026-0858] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.

[CVE-2026-0975] [Modified: 20-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Delta Electronics DIAView has Command Injection vulnerability.

[CVE-2026-23768] [Modified: 23-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.

[CVE-2026-23769] [Modified: 23-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files.

[CVE-2025-14757] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.