CVE-2012-2614

MEDIUM 6.8CVE-2012-2614 · Published 12/07/2012 · updated 16/06/2026

In short

CVE-2012-2614 is a MEDIUM (CVSS 6.8) vulnerability affecting lattice diamond programmer (lattice semiconductor).
Chance of exploitation in the next 30 days (EPSS): 4.1%, higher than 90.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
lattice diamond programmer lattice_semiconductor	`= 1.4.2`	No fix yet

Description

Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long string in a version attribute of an ispXCF element in an .xcf file.

References

archives.neohapsis.com/archives/bugtraq/2012-06/0136.html · Exploit
secunia.com/advisories/48431
coresecurity.com/content/lattice-diamond-programmer-buffer-overflow · Exploit
exploit-db.com/exploits/19340 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free