Fellipe Weno

fweno.onefour.com.br

Current Conditions

São Paulo
nublado

19 ℃

96%

Temperatura

Umidade

Fonte: OpenWeatherMap. - 14:30:02

[USD] USD 62,574.84

[BRL] BRL 325,489.28 [USD] USD 62,574.84 [GBP] GBP 47,449.37 [EUR] EUR 54,988.08
Price index provided by blockchain.info.
After Bitcoin Core 0.14.0 and before Bitcoin Core 29.0, validating a specially-crafted block may cause the node to access previously freed memory.
During validation, necessary data required for checking inputs for each transaction is pre-calculated and cached. For specially crafted invalid blocks, it was possible for this data to be destroyed while it was still being accessed by a background validation thread. An attacker capable of mining a block with sufficient proof-of-work could have exploited this to crash victim nodes. Because of the nature of use-after-free bugs, it is possible that the crash could have been used for remote code execution, though constraints on the input (block) data make this unlikely.
This issue is considered High severity.

Details
By default, script validation for new blocks is dispatched to background threads via a vector of CScriptCheck functors. Each CScriptCheck holds a pointer to a PrecomputedTransactionData object which stores some data needed by each input in the transaction. Because it stores a pointer and not the data itself, care must be taken to ensure that the PrecomputedTransactionData outlives the CScriptCheck.
The script checks lifetime is enforced by an RAII class, CCheckQueueControl. However, the control is intantiated before the precomputed transaction data. Because local objects in C++ are destructed in reverse order of construction, this means the vector of PrecomputedTransactionData is destroyed before the CCheckQueueControl.
This is not an issue when the block is valid, as CCheckQueueControl::Wait() will be called before the function returns and the PrecomputedTransactionData gets destroyed. However, in case of an early return (when a separate check fails) a background script thread may read the precomputed transaction data after it was destroyed. An attacker could exploit this to crash victim nodes at the expense of a valid PoW at tip.

Attribution
Cory Fields (MIT DCI) discovered this vulnerability and responsibly disclosed it in a detailed report containing a proof of concept for reproduction and a proposed mitigation.

Timeline
- 2024-11-02 Cory Fields privately reports the bug
- 2024-11-06 Pieter Wuille pushes a covert fix to already open PR #31112 which works around the issue by removing the early returns
- 2024-12-03 PR #31112 is merged
- 2025-04-12 Bitcoin Core version 29.0 is released with a fix
- 2026-04-19 The last vulnerable Bitcoin Core version (28.x) goes end of life
- 2026-05-05 Public disclosure.

dog - 14:57:11 up 276 days, 23:28, 7 users, load average: 0.00, 0.00, 0.00

[23/06/2026 10:50] Análise: Melhor saída para o Digimais, de Edir Macedo, é solução semelhante à do Panamericano, de Silvio Santos - Valor Econômico

[23/06/2026 06:34] Operação contra CV no Morro Dona Marta provoca tiroteio na zona Sul do Rio - CNN Brasil

[23/06/2026 13:57] Leonardo Sakamoto: Após causar incêndio, Flávio Bolsonaro vai aos EUA se vender como bombeiro - UOL Notícias

[23/06/2026 09:51] Torre Eiffel é fechada por conta da onda de calor em Paris - G1

[22/06/2026 19:54] Defesa de Jaques Wagner aciona STF para barrar operação da PF - Poder360

[23/06/2026 06:00] Ar polar traz mudanças no clima do Sudeste nesta terça-feira - Revista Oeste

[23/06/2026 14:03] Líder do PL aciona embaixada dos EUA após decisão de Mendonça - Metrópoles

[23/06/2026 06:00] Nova Serra das Araras começa a deixar para trás curvas históricas; vídeo mostra trecho de 4km a ser liberado quinta - O Globo

[23/06/2026 05:38] Justiça condena mulher que matou crianças envenenadas com ovo de Páscoa no Maranhão - G1

[23/06/2026 10:30] Motta articula aumentar limite do MEI de R$ 81 mil para R$ 130 mil - Poder360

[CVE-2025-69700] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.5:HIGH] Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio CGI handler.

[CVE-2026-21420] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.3:HIGH] Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution and escalation of privileges.

[CVE-2025-70044] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] An issue pertaining to CWE-295: Improper Certificate Validation was discovered in fofolee uTools-quickcommand 5.0.3.

[CVE-2025-70045] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.4:HIGH] An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTPS request options when 'jx_obj.IsSecure' is true

[CVE-2025-70058] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.4:HIGH] An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests

[CVE-2026-2697] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.3:MEDIUM] An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.

[CVE-2026-3015] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConf. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

[CVE-2026-3016] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2PLimitConfig. The manipulation of the argument except leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

[CVE-2026-22567] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.6:HIGH] Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.

[CVE-2026-22568] [Modified: 17-06-2026] [Analyzed] [V3.1 S5.5:MEDIUM] Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.

[CVE-2026-27511] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an authenticated administrator into unintended interactions that may result in unauthorized configuration changes.

[CVE-2026-27512] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.1:MEDIUM] Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff header and include attacker-influenced content that can be reflected into the response body. Under affected browser behaviors, MIME sniffing may cause the response to be interpreted as active HTML, enabling script execution in the context of the administrative interface.

[CVE-2026-27513] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface. The interface does not implement anti-CSRF protections, allowing an attacker to induce an authenticated administrator to submit state-changing requests, which can result in unauthorized configuration changes.

[CVE-2026-27514] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response includes the router password and administrative password in plaintext. The endpoint also omits appropriate Cache-Control directives, which can allow the response to be stored in client-side caches and recovered by other local users or processes with access to cached browser data.

[CVE-2026-2698] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.5:MEDIUM] An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.

[CVE-2025-61146] [Modified: 17-06-2026] [Analyzed] [V3.1 S4.0:MEDIUM] saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.

[CVE-2025-61147] [Modified: 17-06-2026] [Analyzed] [V3.1 S6.2:MEDIUM] strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table().

[CVE-2025-63945] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.4:HIGH] A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.

[CVE-2025-63946] [Modified: 17-06-2026] [Analyzed] [V3.1 S7.4:HIGH] A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.

[CVE-2025-67733] [Modified: 17-06-2026] [Analyzed] [V3.1 S8.5:HIGH] Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue.