Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

18 ℃

89%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 07:00:02

[USD] USD 81,970.30

[BRL] BRL 402,703.69 [USD] USD 81,970.30 [GBP] GBP 60,159.40 [EUR] EUR 69,604.10
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 07:26:12 up 228 days, 15:57, 3 users, load average: 0.00, 0.00, 0.00

[06/05/2026 00:01] Lula vazou audiência antes de Trump confirmar que o receberia - Diário do Poder

[05/05/2026 21:10] Trump anuncia suspensão da operação militar dos EUA para escoltar navios em Ormuz - Jovem Pan

[05/05/2026 19:46] Ataque a tiros em escola deixa dois mortos e dois feridos no Acre - CNN Brasil

[05/05/2026 19:38] Crusoé: Rubio anuncia fim da operação “Fúria Épica” contra o Irã - O Antagonista

[05/05/2026 23:05] Conselho de Ética aprova suspensão de Van Hattem, Trovão e Pollon - Poder360

[05/05/2026 21:17] 'A incerteza é a parte mais difícil', diz passageiro de cruzeiro com casos de hantavírus - G1

[05/05/2026 18:41] Pacheco diz que perfil moderado tem dificuldade no cenário atual e reforça dúvidas sobre candidatura em MG - O Globo

[05/05/2026 22:29] Ibirité é a nona cidade da Grande BH a enfrentar falta d'água - Estado de Minas

[06/05/2026 01:34] Estupro coletivo em SP: adulto confessa crime e assusta policiais com "insensibilidade" - NSC Total

[05/05/2026 19:52] Fux relata ação que questiona derrota de Messias no Senado - CNN Brasil

[CVE-2025-9318] [Modified: 09-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

[CVE-2025-9637] [Modified: 09-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.

[CVE-2026-21488] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination through its CIccTagText::Read function. This issue is fixed in version 2.3.1.2.

[CVE-2026-21489] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have Out-of-bounds Read and Integer Underflow (Wrap or Wraparound) vulnerabilities in its CIccCalculatorFunc::SequenceNeedTempReset function. This issue is fixed in version 2.3.1.2.

[CVE-2025-14026] [Modified: 10-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed.

[CVE-2025-46696] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.4:MEDIUM] Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

[CVE-2026-21493] [Modified: 14-01-2026] [Analyzed] [V3.1 S6.6:MEDIUM] iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3.1.2.

[CVE-2020-36908] [Modified: 23-02-2026] [Analyzed] [V3.1 S5.3:MEDIUM] SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft a malicious web page that automatically submits a form to create a new super user account with full administrative privileges when a logged-in user visits the page.

[CVE-2020-36909] [Modified: 23-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. Attackers can manipulate POST request parameters in /cgi-bin/cgix/edit_config_files to access and modify files outside the intended /etc/config/ directory.

[CVE-2020-36922] [Modified: 22-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server configurations, and system metadata by sending requests to the exposed system API.

[CVE-2020-36923] [Modified: 22-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Sony BRAVIA Digital Signage 1.7.8 contains an insecure direct object reference vulnerability that allows attackers to bypass authorization controls. Attackers can access hidden system resources like '/#/content-creation' by manipulating client-side access restrictions.

[CVE-2025-14979] [Modified: 09-04-2026] [Analyzed] [V3.1 S7.8:HIGH] AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6.

[CVE-2025-59379] [Modified: 29-01-2026] [Analyzed] [V3.1 S7.5:HIGH] DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Blind SQL Injection through the user parameter in the login page. This allows an attacker to steal credentials, which may be cleartext, from existing users (and admins) and use them to authenticate to the application.

[CVE-2025-60262] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulnerability about vsftpd. Through this vulnerability, all files uploaded anonymously via the FTP protocol is automatically owned by the root user and remote attackers could gain root-level control over the devices.

[CVE-2025-65212] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the device management backend. By reading the corresponding username and self-decrypted MD5 password in the core configuration file, the attacker can directly log in to the backend, thereby bypassing the front-end backend login page.

[CVE-2026-0640] [Modified: 15-01-2026] [Analyzed] [V3.1 S8.8:HIGH] A weakness has been identified in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

[CVE-2025-36589] [Modified: 22-01-2026] [Analyzed] [V3.1 S7.6:HIGH] Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to data and resources outside of the intended sphere of control.

[CVE-2025-60534] [Modified: 29-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate functionality on the web application without the need to authenticate with legitimate credentials.

[CVE-2025-63082] [Modified: 30-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

[CVE-2025-63083] [Modified: 30-01-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Lack of output escaping leads to a XSS vector in the pagebreak plugin.