qt:qtsvg_svg_qsvgrenderer_render: Crash in QRadialFetchSimd<QSimdSse2>::fetch

Detailed Report: https://oss-fuzz.com/testcase?key=4532970396712960 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtsvgsvgqsvgrendererrender Job Type: libfuzzerubsanqt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffe04c63490 Crash State: QRadialFetchSimd::fetch unsigned...

GHSA-H7FF-CFC9-WMMH TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannelGradient`

Impact When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg0=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=None...

CVE-2022-36005

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsgradient receives input min or max that is nonscalar, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

CVE-2022-35990

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

PT-2022-23083

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue arises when the LRNGrad function is given an output image input tensor...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google Inc. in the United States. A security vulnerability exists in Google TensorFlow, which stems from the fact that when tf.quantization.fakequantwithminmaxvarsgradient receives non-scalar inputs min or...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google Inc. in the United States. Google TensorFlow suffers from a security vulnerability that stems from the fact that when tf.quantization.fakequantwithminmaxvarsperchannelgradient receives an input min o...

PT-2022-23088

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue occurs when tf.quantization.fake quant with min max vars per channel...

Malicious code in gradient-stringnnnn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbc90d7f1ec5dc1c1558900467a2043b34a1473f060fa9855e8963f898c382d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3439 Malicious code in gradient-stringnnnn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbc90d7f1ec5dc1c1558900467a2043b34a1473f060fa9855e8963f898c382d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gradient-stringn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113c8aa7e58460260ad95b3d81fb9e9e4630315cd65aca4be2e12ba86400a49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gradient-stringss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57723e32d648c25724e92b0bae70a4858b05de601bcd3c204359d4c4ca01286f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3438 Malicious code in gradient-stringn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113c8aa7e58460260ad95b3d81fb9e9e4630315cd65aca4be2e12ba86400a49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3440 Malicious code in gradient-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85b41f21443655193e21b66bf003d6b42f6bad9f00cc324004094871ca932651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Manipulating Machine-Learning Systems through the Order of the Training Data

Yet another adversarial ML attack: Most deep neural networks are trained by stochastic gradient descent. Now “stochastic” is a fancy Greek word for “random”; it means that the training data are fed into the model in random order. So what happens if the bad guys can cause the order to be not rando...

GHSA-VJG4-V33C-GGC4 Out of bounds read in Tensorflow

Impact The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap: python import tensorflow as tf @tf.function def test: y = tf.rawops.FractionalAvgPoolGrad originputtensorshape=2,2,2,2,...

PYSEC-2022-54

Tensorflow is an Open Source Machine Learning Framework. The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this...

PT-2022-15064

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description The estimator for the cost of some convolution operations in TensorFlow can be mad...

GHSA-7GHQ-FVR3-PJ2X Incomplete validation in `MaxPoolGrad`

Impact An attacker can trigger a denial of service via a segmentation fault in tf.rawops.MaxPoolGrad caused by missing validation: python import tensorflow as tf tf.rawops.MaxPoolGrad originput = tf.constant, shape=3, 0, 0, 2, dtype=tf.float32, origoutput = tf.constant, shape=3, 0, 0, 2,...

CVE-2021-37674

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a segmentation fault in tf.rawops.MaxPoolGrad caused by missing validation. The implementation misses some validation for the originput and origoutput tensor...