Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu pouco nublado

19 ℃

67%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 12:30:01

[USD] USD 72,784.67

[BRL] BRL 368,101.17 [USD] USD 72,784.67 [GBP] GBP 54,161.91 [EUR] EUR 62,461.62
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 12:49:21 up 250 days, 21:20, 4 users, load average: 0.00, 0.00, 0.00

[28/05/2026 09:20] Neymar tem lesão muscular e CBF confirma ausência em amistosos; entenda - CNN Brasil

[28/05/2026 00:02] Lula celebra aprovação do fim da escala 6×1 na Câmara: ‘conquista histórica e civilizatória’ - CartaCapital

[28/05/2026 08:15] Operação Fluxo Oculto faz buscas na Faria Lima e mira fundos, gestoras e seis fintechs - Valor Econômico

[28/05/2026 07:01] Lula vence todos os oponentes no 2º turno, diz Meio/Ideia - Poder360

[28/05/2026 09:23] Big Techs: Alcolumbre aciona jurídico e avalia suspender decretos de Lula - CNN Brasil

[28/05/2026 08:20] A melhora na avaliação do governo Lula, segundo a pesquisa Meio/Ideia - CartaCapital

[27/05/2026 08:21] Lula fala sobre gostar do Brasil 1 dia após encontro Flávio-Trump - Poder360

[28/05/2026 03:01] Dor menstrual provoca faltas mensais de 40% das alunas no Brasil, aponta pesquisa - G1

[28/05/2026 05:00] Surf em Marrocos, falcões em Dubai: o álbum de fotos das viagens de luxo de Vorcaro Vídeo - Metrópoles

[28/05/2026 06:00] Camilo diz que Ciro traiu Izolda e que Cid não entrou na campanha de RC porque sabia de acordo - O POVO

[CVE-2025-59891] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.0:HIGH] Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to change a user's password or create users via '/setup_login?sid=', affecting the 'username', 'password', and 'cpassword' parameters.

[CVE-2025-59892] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.0:HIGH] Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.

[CVE-2025-59893] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.0:HIGH] Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to rename commands via '/rename_command?sid=', affecting the 'command_name' parameter.

[CVE-2025-59894] [Modified: 10-02-2026] [Analyzed] [V3.1 S8.0:HIGH] Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete all commands via '/delete_all_commands?sid='.

[CVE-2025-59895] [Modified: 10-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore functionality. The issue is due to insufficient validation of user-supplied data during this process. An attacker could send malicious requests to alter the configuration file, causing the application to become unresponsive. In a successful scenario, the service may not recover on its own and require a complete reinstallation, as the configuration becomes corrupted and prevents the service from restarting, even manually.

[CVE-2025-59896] [Modified: 10-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_command?sid=', affecting the 'command_name' parameter.

[CVE-2025-59897] [Modified: 10-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/edit_command?sid=', affecting the 'source_dir' and ‘dest_dir’ parameters.

[CVE-2025-59898] [Modified: 10-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/add_exclude_dir?sid=', affecting the 'exclude_dir' parameter.

[CVE-2025-59899] [Modified: 10-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.

[CVE-2025-59900] [Modified: 10-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.

[CVE-2025-57283] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

[CVE-2025-58150] [Modified: 09-02-2026] [Analyzed] [V3.1 S8.8:HIGH] Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.

[CVE-2025-61140] [Modified: 09-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

[CVE-2025-70336] [Modified: 09-02-2026] [Analyzed] [V3.1 S4.8:MEDIUM] A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. The saved payload gets executed on 'View All Live Items' and 'Live Stream' pages.

[CVE-2026-1536] [Modified: 25-03-2026] [Analyzed] [V3.1 S5.8:MEDIUM] A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.

[CVE-2026-1539] [Modified: 25-03-2026] [Analyzed] [V3.1 S5.8:MEDIUM] A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data.

[CVE-2026-23553] [Modified: 09-02-2026] [Analyzed] [V3.1 S2.9:LOW] In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB.

[CVE-2025-65886] [Modified: 03-02-2026] [Analyzed] [V3.1 S7.5:HIGH] A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes.

[CVE-2025-65888] [Modified: 03-02-2026] [Analyzed] [V3.1 S7.5:HIGH] A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.

[CVE-2025-65889] [Modified: 03-02-2026] [Analyzed] [V3.1 S7.5:HIGH] A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.