Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
céu limpo

25 ℃

60%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 14:00:01

[USD] USD 59,605.13

[BRL] BRL 309,118.15 [USD] USD 59,605.13 [GBP] GBP 45,151.96 [EUR] EUR 52,333.42
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 14:10:32 up 281 days, 22:41, 5 users, load average: 0.00, 0.00, 0.00

[28/06/2026 11:43] Esposa e filhos de jogador argentino são encontrados mortos após terremotos na Venezuela - G1

[28/06/2026 09:06] Corpo é encontrado no costão da Niemeyer após cinco dias de buscas por professor de surfe desaparecido no mar - O Globo

[28/06/2026 08:27] Quaest: Lula tem 51% de aprovação entre independentes; 35% das mulheres são anti Flávio Bolsonaro - Revista Fórum

[28/06/2026 06:37] Onda de calor extremo mata 1.000 na França em apenas 3 dias - dw.com

[28/06/2026 11:15] Irmão de Eloá, tenente da Rota baleado segue em estado gravíssimo - UOL Notícias

[28/06/2026 13:25] Irã diz ter atacado alvos ligados aos EUA - CNN Brasil

[28/06/2026 12:24] Mulher morta em Barbacena já havia registrado ocorrência contra o suspeito - Estado de Minas

[27/06/2026 09:14] Veja quem era o casal que morreu após carro cair de viaduto no mar no RJ - Rádio Itatiaia

[27/06/2026 00:01] PT aposta no esquecimento e protela expulsão de vereador ligado ao PCC - Diário do Poder

[28/06/2026 00:00] Copa do Mundo: veja quais capitais terão ponto facultativo ou expediente reduzido no jogo do Brasil - G1

[CVE-2026-28554] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.

[CVE-2026-28555] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

[CVE-2026-28556] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.4:MEDIUM] wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.

[CVE-2026-28557] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

[CVE-2026-28558] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.4:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page.

[CVE-2026-28559] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.3:MEDIUM] wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

[CVE-2026-28560] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript string context and execute arbitrary script in all visitors' browsers.

[CVE-2026-28561] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.

[CVE-2026-28562] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.2:HIGH] wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

[CVE-2026-3376] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

[CVE-2026-3377] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

[CVE-2026-3378] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

[CVE-2026-3379] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

[CVE-2026-3380] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

[CVE-2026-3382] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the file include/chaiscript/dispatchkit/boxed_number.hpp. Performing a manipulation results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3383] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A weakness has been identified in ChaiScript up to 6.1.0. This affects the function chaiscript::Boxed_Number::go of the file include/chaiscript/dispatchkit/boxed_number.hpp. Executing a manipulation can lead to divide by zero. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3384] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A security vulnerability has been detected in ChaiScript up to 6.1.0. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Function_Push_Pop of the file include/chaiscript/language/chaiscript_eval.hpp. The manipulation leads to uncontrolled recursion. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3385] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3386] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A flaw has been found in wren-lang wren up to 0.4.0. Affected by this vulnerability is the function emitOp of the file src/vm/wren_compiler.c. This manipulation causes out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

[CVE-2026-3387] [Modified: 17-06-2026] [Analyzed] [V3.1 S3.3:LOW] A vulnerability has been found in wren-lang wren up to 0.4.0. Affected by this issue is the function getByteCountForArguments of the file src/vm/wren_compiler.c. Such manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.