Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a buffer overflow vulnerability that stems from the DataFormatVecPermute API not validating the src format and dst format attributes. An attacker could exploit the...

Google TensorFlow 输入验证错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a denial-of-service vulnerability that stems from the LSTM GRU layer receiving a zero-length input when using a CUDA backend, which results in a check failure. An...

PT-2020-16393 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 1.15.5 TensorFlow versions prior to 2.0.4 TensorFlow versions prior to 2.1.3 TensorFlow versions prior to 2.2.2 TensorFlow versions prior to 2.3.2 TensorFlow versions prior to 2.4.0 Description: In affected versio...

PT-2020-16389 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 1.15.5 TensorFlow versions prior to 2.0.4 TensorFlow versions prior to 2.1.3 TensorFlow versions prior to 2.2.2 TensorFlow versions prior to 2.3.2 TensorFlow versions prior to 2.4.0 Description: In affected versio...

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow has a security vulnerability that can be exploited by an attacker to access a special directory...

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a buffer overflow vulnerability that stems from a tensor buffer being populated with the default value for the type, but forgetting to initialize the quantized...

PT-2020-16392 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions 2.4.0rc Description: The general implementation for matching filesystem paths to globbing pattern in TensorFlow is vulnerable to an access out of bounds of the array holding the directories. This issue arises due to...

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. TensorFlow suffers from a buffer overflow vulnerability that can be exploited by an attacker to leak addresses from the library...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a buffer overflow vulnerability that can be exploited by an attacker to cause a buffer overflow...

PT-2020-16391 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 1.15.5 TensorFlow versions prior to 2.0.4 TensorFlow versions prior to 2.1.3 TensorFlow versions prior to 2.2.2 TensorFlow versions prior to 2.3.2 TensorFlow versions prior to 2.4.0 Description: The tf.raw...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in TensorFlow

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of TensorFlow. Vulnerability Details CVEID: CVE-2020-15190 DESCRIPTION: TensorFlow is vulnerable to a denial of service, caused by improper input validation by the tf.rawops.Switch operation in eager mode. By...

Float cast overflow undefined behavior

Impact When the boxes argument of tf.image.cropandresize has a very large value, the CPU kernel implementation receives it as a C++ nan floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. Patches We have patched the issue in...

GHSA-XWHF-G6J5-J5GC Float cast overflow undefined behavior

Impact When the boxes argument of tf.image.cropandresize has a very large value, the CPU kernel implementation receives it as a C++ nan floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. Patches We have patched the issue in...

GHSA-RRFP-J2MP-HQ9C Segfault in `tf.quantization.quantize_and_dequantize`

Impact An attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize: python tf.quantization.quantizeanddequantize input=2.5, 2.5, inputmin=0,0, inputmax=1,1, axis=10 This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation:...

Segfault in `tf.quantization.quantize_and_dequantize`

Impact An attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize: python tf.quantization.quantizeanddequantize input=2.5, 2.5, inputmin=0,0, inputmax=1,1, axis=10 This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation:...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2020-62802)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Tensorflow versions prior to 2.4.0, which can be exploited by an attacker to pass an invalid axis value to tf.quantization. digit transformation and dequantize...

Security Bulletin: Numerous CVE entires for TensorFlow in Watson Machine Learning Community Edition

Summary An collection of CVE's have been published for TensorFlow. Details of each are listed. Vulnerability Details CVEID: CVE-2020-15206 DESCRIPTION: TensorFlow is vulnerable to a denial of service, caused by a flaw when changing the SavedModel protocol buffer and altering the name of required...

OPENSUSE-SU-2020:1766-1 Security update for tensorflow2

This update for tensorflow2 fixes the following issues: - updated to 2.1.2 with following fixes boo1177022: Fixes an undefined behavior causing a segfault in tf.rawops.Switch CVE-2020-15190 Fixes three vulnerabilities in conversion to DLPack format CVE-2020-15191, CVE-2020-15192, CVE-2020-15193...

Security Bulletin: CVE-2020-15190 for Tensorflow in Watson Machine Learning Community Edition

Summary In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2020-62809)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Tensorflow versions prior to 2.4.0, which stems from when the parameter to boxes of tf.image.cropandresize has a very large value, and the CPU kernel...