SUSE-SU-2020:3369-1 Security update for go1.14

This update for go1.14 fixes the following issues: - go1.14.12 released 2020-11-12 includes security fixes to the cmd/go and math/big packages. go42553 math/big: panic during recursive division of very large numbers bsc1178750 CVE-2020-28362 go42560 cmd/go: arbitrary code can be injected into cgo...

[ASA-202011-20] raptor: arbitrary code execution

Arch Linux Security Advisory ASA-202011-20 ========================================== Severity: Medium Date : 2020-11-19 CVE-ID : CVE-2017-18926 CVE-2020-25713 Package : raptor Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1283 Summary ======= The package...

RUSTSEC-2020-0071 Potential segfault in the time crate

Impact The affected functions set environment variables without synchronization. On Unix-like operating systems, this can crash in multithreaded programs. Programs may segfault due to dereferencing a dangling pointer if an environment variable is read in a different thread than the affected...

Potential segfault in the time crate

Impact The affected functions set environment variables without synchronization. On Unix-like operating systems, this can crash in multithreaded programs. Programs may segfault due to dereferencing a dangling pointer if an environment variable is read in a different thread than the affected...

Segfault in `tf.quantization.quantize_and_dequantize`

Impact An attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize: python tf.quantization.quantizeanddequantize input=2.5, 2.5, inputmin=0,0, inputmax=1,1, axis=10 This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation:...

GHSA-RRFP-J2MP-HQ9C Segfault in `tf.quantization.quantize_and_dequantize`

Impact An attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize: python tf.quantization.quantizeanddequantize input=2.5, 2.5, inputmin=0,0, inputmax=1,1, axis=10 This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation:...

RUSTSEC-2020-0159 Potential segfault in `localtime_r` invocations

Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library...

Potential segfault in `localtime_r` invocations

Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library...

PT-2020-16364

Name of the Vulnerable Software and Affected Versions time versions 0.2.7 through 0.2.22 time version 0.1 Description Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread...

Denial Of Service (DoS)

dpdk is vulnerable to denial of service DoS. A missing validity check of the descriptor address in the function virtiodevrxbatchpacked could cause segfault via sending invalid Virtio descriptor...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2020-62802)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Tensorflow versions prior to 2.4.0, which can be exploited by an attacker to pass an invalid axis value to tf.quantization. digit transformation and dequantize...

RHEL 8 : dpdk (RHSA-2020:4806)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4806 advisory. The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user...

PT-2020-17547

Name of the Vulnerable Software and Affected Versions futures-intrusive crate versions prior to 0.4.0 Description An issue in the futures-intrusive crate allows cross-thread data races of non-Sync types due to the GenericMutexGuard being given the Sync auto trait as long as the type T is Send. Th...

OPENSUSE-SU-2020:1766-1 Security update for tensorflow2

This update for tensorflow2 fixes the following issues: - updated to 2.1.2 with following fixes boo1177022: Fixes an undefined behavior causing a segfault in tf.rawops.Switch CVE-2020-15190 Fixes three vulnerabilities in conversion to DLPack format CVE-2020-15191, CVE-2020-15192, CVE-2020-15193...

PYSEC-2020-330

In Tensorflow before version 2.4.0, an attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dimsize only does a DCHECK to validate the argument and th...

PYSEC-2020-295

In Tensorflow before version 2.4.0, an attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dimsize only does a DCHECK to validate the argument and th...

CVE-2020-15266

In Tensorflow before version 2.4.0, when the boxes argument of tf.image.cropandresize has a very large value, the CPU kernel implementation receives it as a C++ nan floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. The issue is...

CVE-2020-15265

In Tensorflow before version 2.4.0, an attacker can pass an invalid "axis" value to "tf.quantization.quantizeanddequantize". This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dimsize only does a DCHECK to validate the argument an...

CVE-2020-15265

In Tensorflow before version 2.4.0, an attacker can pass an invalid axis value to tf.quantization.quantizeanddequantize. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dimsize only does a DCHECK to validate the argument and th...

PT-2020-14325 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.4.0 Description: The issue allows an attacker to pass an invalid axis value to tf.quantization.quantize and dequantize, resulting in accessing a dimension outside the rank of the input tensor in the C++ kernel...