PYSEC-2021-682

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in tf.rawops.Reverse. This is because the...

CVE-2021-29575

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.ReverseSequence allows for stack overflow and/or CHECK-fail based denial of service. The...

PYSEC-2021-213

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPool3DGradGrad is vulnerable to a heap buffer overflow. The...

PYSEC-2021-493

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference in the implementation of tf.rawops.SparseFillEmptyRows. This is because of missing...

CVE-2021-29567

TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.SparseDenseCwiseMul, an attacker can trigger denial of service via CHECK-fails or accesses to outside the bounds of heap allocated data. Since the...

CVE-2021-29573

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax is vulnerable to a division by 0. The...

CVE-2020-28014

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten...

CVE-2020-28014: Improper Privilege Management

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-owned files can be overwritten...

New Spectre-Like Attacks

Theres new research that demonstrates security vulnerabilities in all of the AMD and Intel chips with micro-op caches, including the ones that were specifically engineered to be resistant to the Spectre/Meltdown attacks of three years ago. Details: The new line of attacks exploits the micro-op...

Spectre attacks come back from the dead

Spectre is the name for a whole class of vulnerabilities discovered in January 2018 that affected huge numbers of modern computer processors that rely on a performance feature called speculative execution. Since then, some of the world’s most talented computer scientists from industry and academi...

PT-2021-3127

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.94.2 Description The issue is related to errors in privilege management. It allows an attacker to delete arbitrary files in the system by leveraging a delete pid file race condition. This can be done using the -oP and...

AMD RESPONSE TO “I see dead µops: leaking secrets via Intel/AMD micro-op caches” RESEARCH PAPER

Bulletin ID: AMD-SB-1006 Summary AMD has reviewed the research paper and believes existing mitigations were not being bypassed and no new mitigations are required. AMD recommends its existing side-channel mitigation guidance and standard secure coding practices be followed. CVE Details None...

New Attacks Slaughter All Spectre Defenses

All defenses against Spectre side-channel attacks can now be considered broken, leaving billions of computers and other devices just as vulnerable today as they were when the hardware flaw was first announced three years ago. A paper published on Friday by a team of computer scientists from the...

PT-2021-28223

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow crash, specifically a WRITE 8 operation. The crash occurs in the op Const64 function, which is called by...

PT-2021-28210

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow WRITE 8 crash type. The crash state involves several functions, including op Const64, EvaluateExpression,...

PT-2024-11140

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue has been resolved in the Linux kernel, specifically in the spi-zynqmp-gqspi component. The issue occurs when handling op-addr, which uses the buffer "tmpbuf" after...

PT-2021-27493

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a global buffer overflow read of 8 bytes. The crash occurs in the CFF::BlendArg::set blends function,...

Denial Of Service (DoS)

mupdf is vulnerable to denial of service. A NULL pointer dereference in the pdfrunxobject function in pdf-op-run.c during a Fitz fzpaintpixmapwithmask painting operation allows an attacker to crash the application...

PT-2020-4968

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.9.7 Description The issue is related to a slab-out-of-bounds read in the fbcon component of the Linux kernel. This occurs because the KD FONT OP COPY function in drivers/tty/vt/vt.c can be used for manipulation...

Linux kernel code issue vulnerability (CNVD-2020-61025)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A code issue vulnerability exists in Linux kernel confontop, which arises from an improperly designed or implemented code development process for a networked system or...