Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nuvens quebradas

17 ℃

96%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 22:00:02

[USD] USD 79,049.67

[BRL] BRL 401,700.37 [USD] USD 79,049.67 [GBP] GBP 59,310.97 [EUR] EUR 68,014.33
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 22:09:35 up 238 days, 6:40, 3 users, load average: 0.00, 0.01, 0.00

[15/05/2026 18:40] Eduardo assinou contrato como produtor-executivo de filme de Bolsonaro, diz Intercept - O Globo

[15/05/2026 07:15] Ex-governador do Rio Cláudio Castro e dono do Grupo Refit são alvo de operação da PF - R7

[15/05/2026 17:31] Gilmar diz que Fachin "não sabe perder" e obstrui julgamentos - Poder360

[15/05/2026 18:57] PGR denuncia Romeu Zema ao STJ por calúnia contra Gilmar Mendes - CNN Brasil

[15/05/2026 09:04] Flávio diz que Zema "foi precipitado" e agradece apoio de Caiado - Poder360

[15/05/2026 09:29] Lula chamou Magro de 'grande chefe do crime organizado' e disse ter pedido prisão a Trump - O Globo

[15/05/2026 16:07] José Dirceu é diagnosticado com linfoma após internação em São Paulo - Estadão

[15/05/2026 15:39] Mulher que desapareceu no Shopping Morumbi é encontrada no Shopping Ibirapuera, diz polícia - G1

[15/05/2026 11:59] OAB-PA suspende advogadas por uso de 'prompt injection' no PA; presidente cita 'risco à imagem da Ordem' - G1

[15/05/2026 18:01] Trump na China: 3 lugares simbólicos que Xi Jinping escolheu para impressionar americano sua visita ao país - BBC

[CVE-2023-7334] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start. This can result in execution of arbitrary commands in the context of the T+ application service account. Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC).

[CVE-2025-67822] [Modified: 21-01-2026] [Analyzed] [V3.1 S9.4:CRITICAL] A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication mechanisms. A successful exploit could allow an attacker to gain unauthorized access to user or admin accounts in the system.

[CVE-2025-67823] [Modified: 23-01-2026] [Analyzed] [V3.1 S8.2:HIGH] A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to conduct a Cross-Site Scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction where the email channel is enabled. This could allow an attacker to execute arbitrary scripts in the victim's browser or desktop client application.

[CVE-2026-0915] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.

[CVE-2025-68671] [Modified: 25-02-2026] [Analyzed] [V3.1 S6.5:MEDIUM] lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire. This vulnerability is fixed in 1.75.0.

[CVE-2026-1008] [Modified: 23-01-2026] [Analyzed] [V3.1 S7.6:HIGH] A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.

[CVE-2026-1009] [Modified: 23-01-2026] [Analyzed] [V3.1 S9.0:CRITICAL] A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.

[CVE-2026-1010] [Modified: 23-01-2026] [Analyzed] [V3.1 S8.0:HIGH] A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs. A regular authenticated user can inject arbitrary JavaScript into workflow data. When an administrator views the affected workflow, the injected payload executes in the administrator’s browser context, allowing privilege escalation, including creation of new administrator accounts, session token theft, and execution of administrative actions.

[CVE-2026-22045] [Modified: 23-01-2026] [Analyzed] [V3.1 S5.9:MEDIUM] Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.35 and 3.6.7, there is a potential vulnerability in Traefik ACME TLS certificates' automatic generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to tie up go routines and file descriptors indefinitely when the ACME TLS challenge is enabled. A malicious client can open many connections, send a minimal ClientHello with acme-tls/1, then stop responding, leading to denial of service of the entry point. The vulnerability is fixed in 2.11.35 and 3.6.7.

[CVE-2026-22863] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.5:HIGH] Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.

[CVE-2026-22864] [Modified: 21-01-2026] [Analyzed] [V3.1 S8.1:HIGH] Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and therefore can be bypassed when the extension uses alternate casing (for example .BAT, .Bat, etc.). This vulnerability is fixed in 2.5.6.

[CVE-2020-36926] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can access the vulnerable /Management/Chat/frmChatSearch.aspx endpoint to retrieve agents' first and last names along with their unique identifiers.

[CVE-2020-36927] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] DiskPulse Enterprise 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Pulse Enterprise\bin\diskpls.exe' to inject malicious executables and escalate privileges.

[CVE-2020-36928] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Brother\BRAgent\ to inject and execute malicious code with elevated system permissions.

[CVE-2020-36929] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted file paths in BrAuSvc and BRPA_Agent services to inject malicious executables and escalate privileges on the system.

[CVE-2020-36930] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.8:HIGH] SysGauge Server 7.9.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\SysGauge Server\bin\sysgaus.exe' to inject malicious executables and escalate privileges.

[CVE-2021-47780] [Modified: 21-01-2026] [Analyzed] [V3.1 S7.8:HIGH] Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the improperly configured service path to inject malicious executables that will be run with LocalSystem permissions during service startup.

[CVE-2021-47783] [Modified: 09-02-2026] [Analyzed] [V3.1 S5.4:MEDIUM] Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.

[CVE-2021-47785] [Modified: 09-02-2026] [Analyzed] [V3.1 S9.8:CRITICAL] Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. Attackers can craft a malicious payload to overwrite SEH handlers and execute a bind shell on port 3110 by exploiting improper input validation.

[CVE-2021-47786] [Modified: 09-02-2026] [Analyzed] [V3.1 S7.5:HIGH] Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests. Attackers can send a crafted 2000-byte buffer with specific byte patterns to the REDRAGON_MOUSE device to crash the kernel driver.