Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

25 ℃

59%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 14:00:01

[USD] USD 63,935.79

[BRL] BRL 329,371.63 [USD] USD 63,935.79 [GBP] GBP 48,311.74 [EUR] EUR 55,729.63
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 14:28:19 up 273 days, 22:59, 5 users, load average: 0.00, 0.00, 0.00

[20/06/2026 11:44] Governo identificou 10 alertas falsos em sistema da Defesa Civil - CNN Brasil

[20/06/2026 12:05] Datafolha 2º turno: Lula tem 47%, e Flávio Bolsonaro, 43% - G1

[19/06/2026 21:52] Para a PF, Wagner foi intermediário entre Vorcaro e Lula, diz jornal - Poder360

[20/06/2026 10:36] Irã anuncia fechamento do Estreito de Hormuz, diz agência iraniana - UOL Notícias

[20/06/2026 10:26] Polícia prende mais três suspeitos em caso de morte de jovem lançada sem cordas em rope jump - G1

[20/06/2026 09:30] Janaína Figueiredo: A Colômbia de hoje é o Brasil de 2018 com Bolsonaro, diz CEO da Atlas - UOL Notícias

[20/06/2026 08:59] VÍDEO: Acidente envolvendo ao menos 15 veículos deixa um morto e sete feridos na BR-262, na Grande BH - G1

[20/06/2026 08:14] Paraná recebe alerta verdadeiro de tempestades com ventos de até 100 km/h em 69 cidades; veja onde e a previsão do tempo - G1

[20/06/2026 03:30] Acabou a química: na mesma semana, Trump chamou política do Brasil de 'difícil' e Lula, de 'volátil' - O Globo

[20/06/2026 06:19] STF: Por que caso Mariana Ferrer se tornou emblemático e será julgado de novo após decisão do Supremo - BBC

[CVE-2025-52603] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

[CVE-2025-67438] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.

[CVE-2025-70831] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unauthenticated attacker to inject arbitrary operating system commands, leading to complete server compromise.

[CVE-2026-2846] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-2847] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument Isp_Name results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

[CVE-2025-15582] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-15583] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.5:LOW] A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2025-70833] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

[CVE-2026-26093] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.

[CVE-2026-26095] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26096] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26097] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26098] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26099] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.

[CVE-2026-26100] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26101] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26102] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.8:HIGH] Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.

[CVE-2026-26721] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.1:HIGH] An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.

[CVE-2026-26722] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.4:CRITICAL] An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality.

[CVE-2026-26723] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter.