PYSEC-2021-566

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a floating point exception in tf.rawops.ResourceGather. The implementation computes the value of a value, batchsize, and then divides by it without checking that this...

PYSEC-2021-549

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of tf.rawops.SparseDenseCwiseDiv is vulnerable to a division by 0 error. The implementation uses a common class for all binary operations but fails to treat the division by 0 case...

PYSEC-2021-566

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a floating point exception in tf.rawops.ResourceGather. The implementation computes the value of a value, batchsize, and then divides by it without checking that this...

CVE-2021-37647

CVE-2021-37647 describes a null pointer dereference in TensorFlow’s tf.raw_ops.SparseTensorSliceDataset when creating an empty sparse tensor with mismatched indices/values. The description specifies that validation exists but can dereference a null pointer if indices are empty, leading to a crash...

CVE-2021-37643

CVE-2021-37643 affects TensorFlow’s MatrixDiagPartOp. The issue arises when a user does not supply a valid padding value, causing a NULL pointer dereference (if input is empty) or invalid behavior that ignores subsequent values. The root cause is reading the first value from a tensor buffer witho...

CVE-2021-37639

TensorFlow has a local, impactful vulnerability CVE-2021-37639 where restoring tensors via raw APIs can dereference a null pointer or read outside the heap bounds when tensor_name is not provided. The root cause is reading the tensor list from user-controlled input without validating its length, ...

CVE-2021-37640

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of tf.rawops.SparseReshape can be made to trigger an integral division by 0 exception. The implementation calls the reshaping functor whenever there is at least an index in the input but...

PT-2021-21751 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: The implementation of tf.raw ops.SparseDenseCwiseDiv is vulnerable to a division...

PT-2021-21775 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: An attacker can cause undefined behavior via binding a reference to null pointer...

PT-2021-21760 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 Description: The implementation of tf.raw ops.QuantizeAndDequantizeV4Grad is vulnerable to an integer overflow issue caused by converting a signed integer...

PT-2021-21790 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: An attacker can read from outside of bounds of heap allocated data by sending...

Google TensorFlow 输入验证错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in tf.rawops.QuantizeV2 in Google TensorFlow versions prior to 2.6.0. An attacker can exploit the vulnerability to obtain sensitive information...

Google TensorFlow 数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. An integer overflow vulnerability exists in the implementation of tf.rawops.QuantizeAndDequantizeV4Grad in versions prior to Google TensorFlow 2.6.0. The vulnerability stems from converting a signed integer value to an...

Google TensorFlow数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. a security vulnerability exists in the full connectivity layer in TFLite in versions prior to Google TensorFlow 2.6.0. A local attacker could exploit this vulnerability to cause a denial of service...

Google TensorFlow 数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. tf.rawops.ResourceGather in versions prior to Google TensorFlow 2.6.0 is vulnerable to a dezero error. An attacker could exploit this vulnerability to cause a denial of service...

PT-2021-21799 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: The implementation of fully connected layers in TFLite is vulnerable to a divisi...

PT-2021-21800 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4 Description: The implementation of SVDF in TFLite is vulnerable to a null pointer error. The GetVariableInput function can return a...

Google TensorFlow数字错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. An integer division by zero error vulnerability exists in the implementation of tf.rawops.SparseReshape in versions prior to Google TensorFlow 2.6.0. No details of the vulnerability are currently available...

Google TensorFlow 输入验证错误漏洞

Google TensorFlow is an end-to-end open source machine learning platform. A security vulnerability exists in Google TensorFlow versions prior to 2.6.0. An attacker can exploit the vulnerability to execute arbitrary code on the system...

PT-2021-21764 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: The code for tf.raw ops.UncompressElement can be made to trigger a null pointer...