PT-2021-18265 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 Description: The issue arises when the splits argument of RaggedBincount does not specify a valid SparseTensor. This can trigger a heap buffer overflow,...

PT-2021-18344 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: The implementation of the BatchToSpaceNd...

PT-2021-18343 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: The issue arises when the target shape of...

PT-2021-18270 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4 Description: The API of tf.raw ops.SparseCross allows combinations which would result in a CHECK-failure an...

PT-2021-18370 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions 2.1.4 through 2.4.2 TensorFlow versions prior to 2.5.0 Description: Passing invalid arguments, such as those discovered via fuzzing, to tf.raw ops.SparseCountSparseOutput results in a segfault. Recommendations: For version...

PT-2021-18355 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: The TFLite implementation of hashtable...

125softnlp (=0.0.1), a2 (>=0.10.11 <=0.10.13) +4982 more potentially affected by unknown CVE via tensorflow (>=1.0.1 <=2.9.3)

tensorflow PYPI version =1.0.1, =0.10.11, =0.1.0, =0.0.0, =0.5.0, =0.1.6, =1.0.0, =2.0.0, =1.0.0, =0.0.1, =0.0.7 and more Source cves: unknown CVE Source advisory: OSV:OSV-2021-449...

aglvq (=1.0.0), beacon-trellis (=0.1.0) +64 more potentially affected by CVE-2020-26267 via tensorflow (>=2.1.0 <=2.1.2)

tensorflow PYPI version =2.1.0, =3.0.0, =0.0.1, =0.2.0, =0.0.2, =0.1.0, =1.1.0, =0.2.0rc1, =0.2.0rc3 and more Source cves: CVE-2020-26267 Source advisory: OSV:PYSEC-2020-140...

abba-python (>=0.1.6 <=0.3.0), adpred (>=1.1.2 <=1.2.7) +245 more potentially affected by CVE-2020-26268 via tensorflow (>=1.0.1 <=1.15.4)

tensorflow PYPI version =1.0.1, =0.1.6, =1.1.2, =0.0.1, =0.3.26, =0.2.0, =0.4.2, =0.1.1, =0.1.5 - autobazaar =0.1.0 - autogan =0.0.5 - automationobjectdetection-sandeepjena7 =0.0.1 - automl-lib =0.0.1 and more Source cves: CVE-2020-26268 Source advisory: OSV:PYSEC-2020-255...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +86 more potentially affected by CVE-2020-26268 via tensorflow (>=2.2.0 <=2.2.1)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-26268 Source advisory: OSV:PYSEC-2020-255...

ai4bharat-transliteration (>=1.1.0 <=1.1.3), aipack (>=0.0.1 <=0.0.5) +53 more potentially affected by CVE-2020-26270 via tensorflow (>=2.0.0 <=2.0.3)

tensorflow PYPI version =2.0.0, =1.1.0, =0.0.1, =0.1.3.2, =0.2.6, =0.2.0, =0.0.2, =1.0.0.1, =0.0.1, =1.0.4, =0.6.0.post3, =0.1.3, =1.0.0, =1.0.1 and more Source cves: CVE-2020-26270 Source advisory: OSV:PYSEC-2020-256...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +86 more potentially affected by CVE-2020-26270 via tensorflow (>=2.2.0 <=2.2.1)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-26270 Source advisory: OSV:PYSEC-2020-256...

PYSEC-2020-332

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen...

Heap out of bounds access in MakeEdge in TensorFlow

Impact Under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node given by outputindex and the input slot of the dst node given by inputindex. This is...

accuinsight (>=1.0.62 <=3.0.0rc2), adapt-diagnostics (=1.2.0) +106 more potentially affected by CVE-2020-26268 via tensorflow (>=2.3.0 <=2.3.1)

tensorflow PYPI version =2.3.0, =1.0.62, =0.1.0, =0.0.1a0, =0.0.1, =1.0.0rc1, =20210206.0.0, =0.1.0.dev1, =0.2.4, =1.0.1.0, =1.0.3 - cardec-cite =1.1.0 and more Source cves: CVE-2020-26268 Source advisory: OSV:GHSA-HHVC-G5HV-48C6...

Write to immutable memory region in TensorFlow

Impact The tf.rawops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area: python import...

GHSA-HHVC-G5HV-48C6 Write to immutable memory region in TensorFlow

Impact The tf.rawops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area: python import...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +86 more potentially affected by CVE-2020-26267 via tensorflow (>=2.2.0 <=2.2.1)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-26267 Source advisory: OSV:GHSA-C9F3-9WFR-WGH7...

accuinsight (>=1.0.62 <=3.0.0rc2), adapt-diagnostics (=1.2.0) +106 more potentially affected by CVE-2020-26266 via tensorflow (>=2.3.0 <=2.3.1)

tensorflow PYPI version =2.3.0, =1.0.62, =0.1.0, =0.0.1a0, =0.0.1, =1.0.0rc1, =20210206.0.0, =0.1.0.dev1, =0.2.4, =1.0.1.0, =1.0.3 - cardec-cite =1.1.0 and more Source cves: CVE-2020-26266 Source advisory: OSV:GHSA-QHXX-J73R-QPM2...

ai4bharat-transliteration (>=1.1.0 <=1.1.3), aipack (>=0.0.1 <=0.0.5) +53 more potentially affected by CVE-2020-26266 via tensorflow (>=2.0.0 <=2.0.3)

tensorflow PYPI version =2.0.0, =1.1.0, =0.0.1, =0.1.3.2, =0.2.6, =0.2.0, =0.0.2, =1.0.0.1, =0.0.1, =1.0.4, =0.6.0.post3, =0.1.3, =1.0.0, =1.0.1 and more Source cves: CVE-2020-26266 Source advisory: OSV:GHSA-QHXX-J73R-QPM2...