Mick Ayzenberg

A stack-based buffer overflow issue exists, allowing remote attackers to have an unspecified impact. This is achieved by sending a mining.subscribe response with a large `nonce2` length, followed by triggering the overflow with a mining.notify request.

The issue is related to multiple stack-based buffer overflows. These can be triggered by remote pool servers sending a long URL in a client.reconnect stratum message to specific functions. The `extract sockaddr` or `parse reconnect` functions in util.c are affected, potentially allowing remote pool servers to have an unspecified impact.

The issue is related to multiple heap-based buffer overflows in the `parse notify` function. This can be triggered by remote pool servers sending a mining.subscribe response with a large or negative value in the `Extranonc2 size` parameter, followed by a crafted mining.notify request. The impact of this issue is unspecified.

The issue allows man-in-the-middle attackers to cause a denial of service, resulting in application exit. This can be achieved by sending a crafted mining.notify action stratum message with malicious parameters, including `bbversion`, `prev hash`, `nbit`, or `ntime`.