DEBIAN-CVE-2021-43616

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have bee...

CVE-2021-43616

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have bee...

[SECURITY] Fedora 35 Update: dvdauthor-0.7.2-16.fc35

DVDAuthor is a set of tools to help you author the file and directory structure of a DVD-Video disc, including programmatic commands for implementing interactive behavior. It is driven by command lines and XML control files, though there are other programs that provide GUI-based front ends if you...

IBM QRadar Network Security Cross-Site Scripting Vulnerability (CNVD-2021-88187)

IBM QRadar Network Security is a network security manager from IBM, USA. It is used to provide better visibility and control over activities and users on the network, while using deep packet inspection, heuristics and behavior-based analysis to detect and prevent advanced threats. A cross-site...

GHSA-7PXJ-M4JF-R6H2 Missing validation during checkpoint loading

Impact An attacker can trigger undefined behavior, integer overflows, segfaults and CHECK-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. Patches We have patched th...

Incomplete validation of shapes in multiple TF ops

Impact Several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes but in some scenarios writes and reads from heap populated arrays are als...

Undefined behavior via `nullptr` reference binding in sparse matrix multiplication

Impact The code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr: python import tensorflow as tf tf.rawops.SparseMatMul a=1.0,1.0,1.0, b=,,, transposea=False, transposeb=False, aissparse=False, bissparse=True This occurs whenever the dimensio...

GHSA-4F99-P9C2-3J8X Undefined behavior via `nullptr` reference binding in sparse matrix multiplication

Impact The code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr: python import tensorflow as tf tf.rawops.SparseMatMul a=1.0,1.0,1.0, b=,,, transposea=False, transposeb=False, aissparse=False, bissparse=True This occurs whenever the dimensio...

Mozilla Firefox Security Advisory (MFSA2020-45) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

CVE-2021-41208

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...

PYSEC-2021-845

TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes...

PYSEC-2021-815

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...

Heap overflow

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...

CVE-2021-41208

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...

CVE-2021-41208

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding...

CVE-2021-41208

CVE-2021-41208 involves TensorFlow boosted trees code with missing validation. The root cause is incomplete validation in boosted trees APIs, enabling a local attacker to trigger denial of service (via dereferencing null pointers or CHECK failures) and to cause undefined behavior (binding referen...

CVE-2021-41219

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr. This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empt...

Heap overflow

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr. This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empt...

PYSEC-2021-406

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for tf.ragged.cross has an undefined behavior due to binding a reference to nullptr. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1,...

PYSEC-2021-826

TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr. This occurs whenever the dimensions of a or b are 0 or less. In the case on one of these is 0, an empt...