Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens dispersas

25 ℃

57%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 15:00:01

[USD] USD 58,332.30

[BRL] BRL 302,220.94 [USD] USD 58,332.30 [GBP] GBP 44,002.21 [EUR] EUR 51,074.95
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 15:29:39 up 284 days, 0 min, 7 users, load average: 0.00, 0.00, 0.00

[30/06/2026 14:10] Paquetá volta a jogar na Copa do Mundo? Previsão da Seleção Brasileira é pessimista; veja bastidores - ESPN Brasil

[30/06/2026 12:39] TRT e MP sugerem trégua na greve dos rodoviários; sindicato se reúne para avaliar proposta - G1

[30/06/2026 08:52] Suprema Corte rejeita plano de Trump que restringe cidadania por nascimento - CNN Brasil

[30/06/2026 13:36] STF conclui julgamento e libera parte dos penduricalhos a magistrados - CNN Brasil

[29/06/2026 19:21] Mãe resgatada com bebê de 18 dias após terremoto na Venezuela: 'Ele foi meu motor para continuar viva' - BBC

[29/06/2026 14:05] Lula anuncia aporte de US$ 100 milhões para fundo do Mercosul - Brasil 247

[29/06/2026 15:33] Motta recebe de Lula projeto do governo sobre aumento do limite do MEI - Notícias - Portal da Câmara dos Deputados

[30/06/2026 10:24] Valdemar se reúne com Michelle após vídeo sobre Flávio Bolsonaro - Poder360

[30/06/2026 09:43] Velório de Ricardo Bocão é na escola de surfe que fundou, na Rocinha - O Globo

[30/06/2026 09:46] Caiado deve anunciar Kassab como vice na disputa pela Presidência - CNN Brasil

[CVE-2024-47886] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26.

[CVE-2024-50337] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28.

[CVE-2025-50186] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.8:MEDIUM] Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30.

[CVE-2025-50187] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.

[CVE-2025-50188] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.

[CVE-2025-50189] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.

[CVE-2025-50190] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30.

[CVE-2025-50191] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.

[CVE-2025-50192] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.

[CVE-2025-52482] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.3:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30.

[CVE-2026-0995] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.6:LOW] An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to ensure the completion of memory accesses related to SME.

[CVE-2026-24107] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may lead to critical command injection vulnerabilities.

[CVE-2026-24108] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size validation, it could lead to a buffer overflow vulnerability.

[CVE-2026-26694] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.

[CVE-2026-26696] [Modified: 17-06-2026] [Analyzed] [V3.1 S9.8:CRITICAL] code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php.

[CVE-2025-50193] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30.

[CVE-2025-50194] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This issue has been patched in version 1.11.30.

[CVE-2025-50195] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. This issue has been patched in version 1.11.30.

[CVE-2025-50196] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30.

[CVE-2025-50197] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.2:HIGH] Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30.