CVE-2014-4501

Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.

• CWE-119

• http://seclists.org/fulldisclosure/2014/Jul/118
• https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272eExploit, Patch
• https://github.com/luke-jr/bfgminer/commit/c80ad8548251eb0e15329fc240c89070640c9d79Patch
• https://github.com/sgminer-dev/sgminer/commit/78cc408369bdbbd440196c93574098d1482efbceExploit, Patch
• https://github.com/sgminer-dev/sgminer/commit/b65574bef233474e915fdf18614aa211e31cc6c2Patch
• http://seclists.org/fulldisclosure/2014/Jul/118
• https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272eExploit, Patch
• https://github.com/luke-jr/bfgminer/commit/c80ad8548251eb0e15329fc240c89070640c9d79Patch
• https://github.com/sgminer-dev/sgminer/commit/78cc408369bdbbd440196c93574098d1482efbceExploit, Patch
• https://github.com/sgminer-dev/sgminer/commit/b65574bef233474e915fdf18614aa211e31cc6c2Patch

Published

Jul 23, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-4494Springboard in Apple iOS before 8.1.3 does not properly vali…
• CVE-2014-4495The kernel in Apple iOS before 8.1.3, Apple OS X before 10.1…
• CVE-2014-4496The mach_port_kobject interface in the kernel in Apple iOS b…
• CVE-2014-4497Integer signedness error in IOBluetoothFamily in the Bluetoo…
• CVE-2014-4498The CPU Software in Apple OS X before 10.10.2 allows physica…
• CVE-2014-4499The App Store process in CommerceKit Framework in Apple OS X…
• CVE-2014-4502Multiple heap-based buffer overflows in the parse_notify fun…
• CVE-2014-4503The parse_notify function in util.c in sgminer before 4.2.2 …
• CVE-2014-4505Cross-site scripting (XSS) vulnerability in the Easy Breadcr…
• CVE-2014-4506Cross-site scripting (XSS) vulnerability in the Custom Meta …
• CVE-2014-4507Directory traversal vulnerability in Smart-Proxy in Foreman …
• CVE-2014-4508arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.…