CVE-2014-4502

sgminer <4.2.2, cgminer <4.3.5, BFGMiner <4.1.0 - Buffer Overflow

Title source: llm
STIX 2.1

Description

Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/68831
Issue Tracking x_refsource_confirm
https://github.com/sgminer-dev/sgminer/issues/258
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Jul/119

Scores

EPSS 0.0330
EPSS Percentile 87.1%

Details

CWE
CWE-119
Status published
Products (17)
bfgminer/bfgminer 3.2.0
bfgminer/bfgminer 3.2.1
bfgminer/bfgminer 3.2.2
bfgminer/bfgminer 3.2.3
bfgminer/bfgminer 3.2.4
bfgminer/bfgminer 3.2.5
bfgminer/bfgminer 3.2.6
bfgminer/bfgminer 3.2.7
bfgminer/bfgminer 3.2.8
bfgminer/bfgminer < 4.0.0
... and 7 more
Published Jul 23, 2014
Tracked Since Feb 18, 2026