Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

17 ℃

91%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 19:30:01

[USD] USD 77,362.01

[BRL] BRL 387,885.39 [USD] USD 77,362.01 [GBP] GBP 57,574.51 [EUR] EUR 66,533.26
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 19:44:19 up 243 days, 4:15, 3 users, load average: 0.00, 0.00, 0.00

[20/05/2026 12:55] Flávio Bolsonaro teve reembolso de viagem a SP um dia após Vorcaro ser liberado da prisão - ICL Notícias

[20/05/2026 17:16] Marco Civil da Internet: o que muda com as novas regras para big techs - CNN Brasil

[20/05/2026 16:38] Assassinato e conspiração: Entenda acusações dos EUA contra Raúl Castro - CNN Brasil

[20/05/2026 12:30] Defesa diz que empresária afirmou em depoimento à PF que nunca 'repassou qualquer valor' a Lulinha - G1

[20/05/2026 07:34] Polícia encontra corpo de desembargador desaparecido no Rio - CartaCapital

[20/05/2026 15:24] PL se reposiciona e assumirá campanha contra PEC da 6x1 - CNN Brasil

[20/05/2026 14:31] Não foi um erro: mulher que descobriu registro de presidente na carteira de trabalho quer justiça - Folha PE

[20/05/2026 13:42] Brasília garante o 2º lugar de capital com melhor qualidade de vida do país - Correio Braziliense

[20/05/2026 12:38] Presidente Lula assina pacote de medidas para ampliar proteção às mulheres e reforçar segurança digital no Brasil - www.gov.br

[20/05/2026 13:52] Moraes ordena que governo tome medidas sobre extradição de Carla Zambelli - Estado de Minas

[CVE-2025-33015] [Modified: 26-01-2026] [Analyzed] [V3.1 S8.8:HIGH] IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface.

[CVE-2025-36058] [Modified: 17-02-2026] [Analyzed] [V3.1 S5.5:MEDIUM] IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation and IBM Business Automation Workflow containers may disclose sensitve configuration information in a config map.

[CVE-2025-36059] [Modified: 17-02-2026] [Analyzed] [V3.1 S4.7:MEDIUM] IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls.

[CVE-2025-36063] [Modified: 05-02-2026] [Analyzed] [V3.1 S6.3:MEDIUM] IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

[CVE-2025-36065] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.3:MEDIUM] IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.

[CVE-2025-36066] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.1:MEDIUM] IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[CVE-2025-36113] [Modified: 03-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[CVE-2025-36115] [Modified: 03-02-2026] [Analyzed] [V3.1 S6.3:MEDIUM] IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system.

[CVE-2025-36396] [Modified: 26-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[CVE-2025-36397] [Modified: 26-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

[CVE-2025-36408] [Modified: 26-01-2026] [Analyzed] [V3.1 S6.4:MEDIUM] IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[CVE-2025-36409] [Modified: 26-01-2026] [Analyzed] [V3.1 S5.4:MEDIUM] IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

[CVE-2025-36410] [Modified: 26-01-2026] [Analyzed] [V3.1 S3.1:LOW] IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security.

[CVE-2025-36411] [Modified: 26-01-2026] [Analyzed] [V3.1 S3.5:LOW] IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

[CVE-2025-36418] [Modified: 26-01-2026] [Analyzed] [V3.1 S7.3:HIGH] IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.

[CVE-2025-36419] [Modified: 26-01-2026] [Analyzed] [V3.1 S5.3:MEDIUM] IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system.

[CVE-2025-56353] [Modified: 03-02-2026] [Analyzed] [V3.1 S7.5:HIGH] In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), a memory leak occurs due to the broker's failure to validate or reject malformed UTF-8 strings in topic filters. An attacker can exploit this by sending repeated subscription requests with arbitrarily large or invalid filter payloads. Each request causes memory to be allocated for the malformed topic filter, but the broker does not free the associated memory, leading to unbounded heap growth and potential denial of service under sustained attack.

[CVE-2025-64087] [Modified: 03-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

[CVE-2025-65482] [Modified: 03-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.

[CVE-2025-33228] [Modified: 02-02-2026] [Analyzed] [V3.1 S7.3:HIGH] NVIDIA Nsight Systems contains a vulnerability in the gfx_hotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the process_nsys_rep_cli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.