Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

20 ℃

78%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 13:30:01

[USD] USD 65,680.74

[BRL] BRL 334,512.02 [USD] USD 65,680.74 [GBP] GBP 48,881.05 [EUR] EUR 56,539.69
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 13:57:27 up 269 days, 22:28, 6 users, load average: 0.00, 0.00, 0.00

[16/06/2026 11:21] Moraes dá 24 horas para Bolsonaro explicar por que mantinha arma de fogo em casa durante prisão domiciliar - G1

[16/06/2026 10:38] Lula e Trump posam juntos na foto oficial do G7 em meio a tensão por tarifas - G1

[15/06/2026 12:53] Quem era Oliver Tree, cantor americano morto em acidente de helicóptero no Rio de Janeiro - BBC

[16/06/2026 11:07] A disputa pela Presidência no 1º turno, segundo nova pesquisa CNT/MDA - CartaCapital

[16/06/2026 07:00] EUA prendem brasileiro apontado como ex-chefe de PCC e CV - Poder360

[15/06/2026 10:47] Irã contradiz afirmação de Trump sobre Ormuz ficar "livre de pedágio" - CNN Brasil

[16/06/2026 09:02] Grupo de WhatsApp e dicas para ‘salto viralizar’: como era o esquema do rope jump que matou jovem - Estadão

[16/06/2026 11:33] Rio Grande do Sul gela com frio de 6ºC abaixo de zero - MetSul Meteorologia

[16/06/2026 06:02] Entenda o julgamento de Eduardo Bolsonaro no STF - Poder360

[16/06/2026 08:39] Caneta de semaglutida brasileira chega às farmácias com preços a partir de R$ 452 - G1

[CVE-2025-14350] [Modified: 18-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563

[CVE-2025-14573] [Modified: 18-02-2026] [Analyzed] [V3.1 S3.8:LOW] Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

[CVE-2026-1046] [Modified: 23-03-2026] [Analyzed] [V3.1 S7.6:HIGH] Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577

[CVE-2026-2556] [Modified: 29-04-2026] [Analyzed] [V3.1 S6.3:MEDIUM] A security vulnerability has been detected in cskefu up to 8.0.1. This issue affects some unknown processing of the file com/cskefu/cc/controller/resource/MediaController.java of the component Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2026-1333] [Modified: 26-02-2026] [Analyzed] [V3.1 S7.8:HIGH] A Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.

[CVE-2026-1334] [Modified: 26-02-2026] [Analyzed] [V3.1 S7.8:HIGH] An Out-Of-Bounds Read vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.

[CVE-2026-1335] [Modified: 26-02-2026] [Analyzed] [V3.1 S7.8:HIGH] An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.

[CVE-2026-2557] [Modified: 29-04-2026] [Analyzed] [V3.1 S3.5:LOW] A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the component File Upload. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-65715] [Modified: 25-02-2026] [Analyzed] [V3.1 S7.8:HIGH] An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.

[CVE-2025-65716] [Modified: 25-02-2026] [Analyzed] [V3.1 S8.8:HIGH] An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.

[CVE-2026-2565] [Modified: 18-02-2026] [Analyzed] [V3.1 S6.6:MEDIUM] A weakness has been identified in Wavlink WL-NU516U1 20251208. Affected by this issue is the function sub_40785C of the file /cgi-bin/adm.cgi. This manipulation of the argument time_zone causes stack-based buffer overflow. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2019-25378] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple cross-site scripting vulnerabilities in the proxy.cgi endpoint that allow attackers to inject malicious scripts through parameters including CACHE_SIZE, MAX_SIZE, MIN_SIZE, MAX_OUTGOING_SIZE, and MAX_INCOMING_SIZE. Attackers can submit POST requests with script payloads to store or reflect arbitrary JavaScript code that executes in users' browsers when the proxy configuration page is accessed.

[CVE-2019-25379] [Modified: 20-02-2026] [Analyzed] [V3.1 S7.2:HIGH] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains stored and reflected cross-site scripting vulnerabilities in the urlfilter.cgi endpoint that allow attackers to inject malicious scripts. Attackers can submit POST requests with script payloads in the REDIRECT_PAGE or CHILDREN parameters to execute arbitrary JavaScript in user browsers.

[CVE-2019-25380] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the dhcp.cgi script that allow attackers to inject malicious scripts through multiple parameters. Attackers can submit POST requests to dhcp.cgi with script payloads in parameters such as BOOT_SERVER, BOOT_FILE, BOOT_ROOT, START_ADDR, END_ADDR, DNS1, DNS2, NTP1, NTP2, WINS1, WINS2, DEFAULT_LEASE_TIME, MAX_LEASE_TIME, DOMAIN_NAME, NIS_DOMAIN, NIS1, NIS2, STATIC_HOST, STATIC_DESC, STATIC_MAC, and STATIC_IP to execute arbitrary JavaScript in user browsers.

[CVE-2019-25381] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests to the hosts.cgi endpoint with script payloads in the IP, HOSTNAME, or COMMENT parameters to execute arbitrary JavaScript in users' browsers.

[CVE-2019-25382] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the NTP_SERVER parameter. Attackers can send POST requests to the time.cgi endpoint with script payloads in the NTP_SERVER parameter to execute arbitrary JavaScript in users' browsers.

[CVE-2019-25383] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the apcupsd.cgi script that allow attackers to inject malicious scripts through multiple POST parameters. Attackers can submit crafted POST requests with script payloads in parameters like BATTLEVEL, RTMIN, BATTDELAY, TO, ANNOY, UPSIP, UPSNAME, UPSPORT, POLLTIME, UPSUSER, NISPORT, UPSAUTH, EMAIL, FROM, CC, SMSEMAIL, SMTPSERVER, PORT, USER, and EMAIL_PASSWORD to execute arbitrary JavaScript in victim browsers.

[CVE-2019-25384] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the portfw.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the EXT, SRC_PORT_SEL, SRC_PORT, DEST_IP, DEST_PORT_SEL, or COMMENT parameters to execute arbitrary JavaScript in users' browsers.

[CVE-2019-25385] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the MACHINE and MACHINECOMMENT parameters. Attackers can send POST requests to the outgoing.cgi endpoint with script payloads to execute arbitrary JavaScript in users' browsers and steal session data.

[CVE-2019-25386] [Modified: 20-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the dmzholes.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. Attackers can submit POST requests with script payloads in the SRC_IP, DEST_IP, or COMMENT parameters to execute arbitrary JavaScript in users' browsers.