CVE-2021-29524

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropFilter. This is because the...

CVE-2021-29530

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference by providing an invalid permutation to tf.rawops.SparseMatrixSparseCholesky. This is because the...

Type confusion

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.io.decoderaw produces incorrect results and crashes the Python interpreter when combining fixedlength and wider datatypes. The implementation of the padded...

PYSEC-2021-453

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropInput. This is because the...

pycnet-audio (>=0.5.1 <=0.5.8), qihoo-tensornet (>=0.102.0.dev0 <=0.102.2.post1) potentially affected by CVE-2021-29583 via tensorflow-cpu (>=2.2.0 <=2.2.3)

tensorflow-cpu PYPI version =2.2.0, =0.5.1, =0.102.0.dev0, =0.102.2.post1 Source cves: CVE-2021-29583 Source advisory: OSV:PYSEC-2021-511...

PYSEC-2021-465

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in QuantizedResizeBilinear by passing in invalid thresholds for the quantization. This is because the...

PYSEC-2021-641

TensorFlow is an end-to-end open source platform for machine learning. The implementation of MatrixDiag operationshttps://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrixdiagop.ccL195-L197 does not validate that the tensor...

pycnet-audio (>=0.5.1 <=0.5.8), qihoo-tensornet (>=0.102.0.dev0 <=0.102.2.post1) potentially affected by CVE-2021-29538 via tensorflow-cpu (>=2.2.0 <=2.2.3)

tensorflow-cpu PYPI version =2.2.0, =0.5.1, =0.102.0.dev0, =0.102.2.post1 Source cves: CVE-2021-29538 Source advisory: OSV:PYSEC-2021-466...

pycnet-audio (>=0.5.1 <=0.5.8), qihoo-tensornet (>=0.102.0.dev0 <=0.102.2.post1) potentially affected by CVE-2021-29544 via tensorflow-cpu (>=2.2.0 <=2.2.3)

tensorflow-cpu PYPI version =2.2.0, =0.5.1, =0.102.0.dev0, =0.102.2.post1 Source cves: CVE-2021-29544 Source advisory: OSV:PYSEC-2021-472...

Heap overflow

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.AvgPool3DGrad is vulnerable to a heap buffer overflow. The...

Heap overflow

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGrad is vulnerable to a heap buffer overflow. The...

Design/Logic Flaw

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error. An attacker can craft a model such that one dimension of the block input is 0. Hence, the corresponding value in blockshape is...

Design/Logic Flaw

TensorFlow is an end-to-end open source platform for machine learning. The optimized implementation of the TransposeConv TFLite operator is vulnerable to a division by zero error. An attacker can craft a model such that strideh,w values are 0. Code calling this function must validate these...

PYSEC-2021-215

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.FractionalAvgPoolGrad is vulnerable to a heap buffer overflow. The...

PYSEC-2021-542

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.io.decoderaw produces incorrect results and crashes the Python interpreter when combining fixedlength and wider datatypes. The implementation of the padded...

PYSEC-2021-545

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via CHECK-fail in tf.strings.substr with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3,...

PYSEC-2021-519

TensorFlow is an end-to-end open source platform for machine learning. TFlite graphs must not have loops between nodes. However, this condition was not checked and an attacker could craft models that would result in infinite loop during evaluation. In certain cases, the infinite loop would be...

Design/Logic Flaw

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the DepthToSpace TFLite operator is vulnerable to a division by zero...

PYSEC-2021-507

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGrad is vulnerable to a heap buffer overflow. The...

PYSEC-2021-253

TensorFlow is an end-to-end open source platform for machine learning. The implementation of TrySimplifyhttps://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmeticoptimizer.ccL390-L401 has undefined behavior due to...