GHSA-XVWP-H6JV-7472 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

🗓️ 21 Nov 2022 22:03:45Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Heap out-of-bounds in Fractional Max Pool and Fractional Average Pool when pooling_ratio < 1; patch in commit 216525144..., fixed in TensorFlow 2.11.0 and cherry-picked to 2.10.1.

Reporter	Title	Published	Views	Family All 33
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulerabilities in TensorFlow	6 Jul 202317:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in TensorFlow	30 Jan 202317:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	2 Feb 202303:37	–	ibm
IBM Security Bulletins	Security Bulletin: tensorflow-2.7.3-cp37 vulnerable to CVE-2022-41911 CVE-2022-41907 CVE-2022-41908 CVE-2022-41896 CVE-2022-41891 CVE-2022-41894 CVE-2022-41884 IBM Maximo Application Suite - Monitor Component	6 Jun 202321:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	15 Dec 202203:09	–	ibm
CBLMariner	CVE-2022-41900 affecting package tensorflow for versions less than 2.11.0-1	9 Dec 202220:03	–	cbl_mariner
CNNVD	Google TensorFlow 缓冲区错误漏洞	18 Nov 202200:00	–	cnnvd
CNVD	Google TensorFlow buffer overflow vulnerability (CNVD-2022-80684)	23 Nov 202200:00	–	cnvd
CVE	CVE-2022-41900	18 Nov 202200:00	–	cve
Cvelist	CVE-2022-41900 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow	18 Nov 202200:00	–	cvelist

Source	Link
github	www.github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-41900
github	www.github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48
github	www.github.com/tensorflow/tensorflow

13 Jul 2026 16:43Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.1

EPSS0.00631