Candidate: CVE-2014-4502
PublicDate: 2014-07-23 14:55:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4502
 https://github.com/sgminer-dev/sgminer/commit/bac5831b355f916e0696b7bbcccfc51c057b729a
 https://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9
 https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272e
 https://github.com/sgminer-dev/sgminer/issues/258
 http://seclists.org/fulldisclosure/2014/Jul/119
Description:
 Multiple heap-based buffer overflows in the parse_notify function in
 sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow
 remote pool servers to have unspecified impact via a (1) large or (2)
 negative value in the Extranonc2_size parameter in a mining.subscribe
 response and a crafted mining.notify request.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_cgminer:
 upstream: https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272e
upstream_cgminer: released (4.3.5)
lucid_cgminer: DNE
precise_cgminer: DNE
precise/esm_cgminer: DNE
trusty_cgminer: ignored (reached end-of-life)
trusty/esm_cgminer: DNE (trusty was needed)
utopic_cgminer: ignored (reached end-of-life)
vivid_cgminer: ignored (reached end-of-life)
vivid/stable-phone-overlay_cgminer: DNE
vivid/ubuntu-core_cgminer: DNE
wily_cgminer: ignored (reached end-of-life)
xenial_cgminer: not-affected
yakkety_cgminer: ignored (reached end-of-life)
zesty_cgminer: ignored (reached end-of-life)
artful_cgminer: ignored (reached end-of-life)
bionic_cgminer: not-affected
cosmic_cgminer: not-affected
disco_cgminer: not-affected
devel_cgminer: not-affected

Patches_bfgminer:
 upstream: https://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9
upstream_bfgminer: released (4.1.0)
lucid_bfgminer: DNE
precise_bfgminer: DNE
precise/esm_bfgminer: DNE
trusty_bfgminer: ignored (reached end-of-life)
trusty/esm_bfgminer: DNE (trusty was needed)
utopic_bfgminer: ignored (reached end-of-life)
vivid_bfgminer: ignored (reached end-of-life)
vivid/stable-phone-overlay_bfgminer: DNE
vivid/ubuntu-core_bfgminer: DNE
wily_bfgminer: ignored (reached end-of-life)
xenial_bfgminer: not-affected
yakkety_bfgminer: ignored (reached end-of-life)
zesty_bfgminer: ignored (reached end-of-life)
artful_bfgminer: ignored (reached end-of-life)
bionic_bfgminer: not-affected
cosmic_bfgminer: not-affected
disco_bfgminer: DNE
devel_bfgminer: DNE