<div dir="ltr">The CVE specifically says CPUminer which is not used for Bitcoin anymore (or shouldn't be), not CGminer.  Can someone who has the ability to change CVE Bug Reports fix this?</div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Dec 20, 2014 at 9:22 PM, Michael Gilbert <span dir="ltr"><<a href="mailto:mgilbert@debian.org" target="_blank">mgilbert@debian.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Package: cgminer<br>
Severity: important<br>
Tags: security<br>
<br>
Hi,<br>
<br>
the following vulnerability was published for cgminer.<br>
<br>
CVE-2014-6251[0]:<br>
| Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote<br>
| attackers to have an unspecified impact by sending a mining.subscribe<br>
| response with a large nonce2 length, then triggering the overflow with<br>
| a mining.notify request.<br>
<br>
Details are sparse, and note that the report is about cpuminer rather<br>
than cgminer, but since the two share a lot of code, I couldn't easily<br>
rule out cgminer being affected, so some research needs to be done.<br>
<br>
If you fix the vulnerability please also make sure to include the<br>
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.<br>
<br>
For further information see:<br>
<br>
[0] <a href="https://security-tracker.debian.org/tracker/CVE-2014-6251" target="_blank">https://security-tracker.debian.org/tracker/CVE-2014-6251</a><br>
<br>
Please adjust the affected versions in the BTS as needed.<br>
<br>
_______________________________________________<br>
Pkg-bitcoin-devel mailing list<br>
<a href="mailto:Pkg-bitcoin-devel@lists.alioth.debian.org">Pkg-bitcoin-devel@lists.alioth.debian.org</a><br>
<a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-bitcoin-devel" target="_blank">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-bitcoin-devel</a><br>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><div> </div><div>Shawn L. Djernes<br>SD Consulting LLC<br><a href="mailto:sdjernes@gmail.com" target="_blank">sdjernes@gmail.com</a><br>402.345.7734 | 402.350.6973 Cell</div><div>Fax: 888.297.6310</div><div> </div><div>Apple Certified Consultant</div><div>Special Deals:</div><div><a href="http://www.anrdoezrs.net/click-6259053-11031064" target="_blank">iPad with Retina Display. From $499.</a></div></div></div>
</div>