PT-2021-18316 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: An attacker can trigger a null pointer...

PT-2021-18370 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions 2.1.4 through 2.4.2 TensorFlow versions prior to 2.5.0 Description: Passing invalid arguments, such as those discovered via fuzzing, to tf.raw ops.SparseCountSparseOutput results in a segfault. Recommendations: For version...

PT-2021-18265 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 Description: The issue arises when the splits argument of RaggedBincount does not specify a valid SparseTensor. This can trigger a heap buffer overflow,...

Google TensorFlow缓冲区错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4, which stems from tf.rawops.QuantizeAndDequantizeV2 allows invalid values for the axis parameter:. No...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4, which stems from a lack of validation in tf.rawops.RaggedTensorToTensor, and can be exploited by an...

PT-2021-18338 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier Description: The Prepare step of the SpaceToDepth TFLit...

125softnlp (=0.0.1), a2 (>=0.10.11 <=0.10.13) +4982 more potentially affected by unknown CVE via tensorflow (>=1.0.1 <=2.9.3)

tensorflow PYPI version =1.0.1, =0.10.11, =0.1.0, =0.0.0, =0.5.0, =0.1.6, =1.0.0, =2.0.0, =1.0.0, =0.0.1, =0.0.7 and more Source cves: unknown CVE Source advisory: OSV:OSV-2021-449...

ai4bharat-transliteration (>=1.1.0 <=1.1.3), aipack (>=0.0.1 <=0.0.5) +53 more potentially affected by CVE-2020-26270 via tensorflow (>=2.0.0 <=2.0.3)

tensorflow PYPI version =2.0.0, =1.1.0, =0.0.1, =0.1.3.2, =0.2.6, =0.2.0, =0.0.2, =1.0.0.1, =0.0.1, =1.0.4, =0.6.0.post3, =0.1.3, =1.0.0, =1.0.1 and more Source cves: CVE-2020-26270 Source advisory: OSV:PYSEC-2020-256...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +86 more potentially affected by CVE-2020-26268 via tensorflow (>=2.2.0 <=2.2.1)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-26268 Source advisory: OSV:PYSEC-2020-255...

PYSEC-2020-332

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen...

abba-python (>=0.1.6 <=0.3.0), adpred (>=1.1.2 <=1.2.7) +245 more potentially affected by CVE-2020-26268 via tensorflow (>=1.0.1 <=1.15.4)

tensorflow PYPI version =1.0.1, =0.1.6, =1.1.2, =0.0.1, =0.3.26, =0.2.0, =0.4.2, =0.1.1, =0.1.5 - autobazaar =0.1.0 - autogan =0.0.5 - automationobjectdetection-sandeepjena7 =0.0.1 - automl-lib =0.0.1 and more Source cves: CVE-2020-26268 Source advisory: OSV:PYSEC-2020-255...

aglvq (=1.0.0), beacon-trellis (=0.1.0) +64 more potentially affected by CVE-2020-26267 via tensorflow (>=2.1.0 <=2.1.2)

tensorflow PYPI version =2.1.0, =3.0.0, =0.0.1, =0.2.0, =0.0.2, =0.1.0, =1.1.0, =0.2.0rc1, =0.2.0rc3 and more Source cves: CVE-2020-26267 Source advisory: OSV:PYSEC-2020-140...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +86 more potentially affected by CVE-2020-26270 via tensorflow (>=2.2.0 <=2.2.1)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-26270 Source advisory: OSV:PYSEC-2020-256...

Heap out of bounds access in MakeEdge in TensorFlow

Impact Under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node given by outputindex and the input slot of the dst node given by inputindex. This is...

accuinsight (>=1.0.62 <=3.0.0rc2), adapt-diagnostics (=1.2.0) +106 more potentially affected by CVE-2020-26268 via tensorflow (>=2.3.0 <=2.3.1)

tensorflow PYPI version =2.3.0, =1.0.62, =0.1.0, =0.0.1a0, =0.0.1, =1.0.0rc1, =20210206.0.0, =0.1.0.dev1, =0.2.4, =1.0.1.0, =1.0.3 - cardec-cite =1.1.0 and more Source cves: CVE-2020-26268 Source advisory: OSV:GHSA-HHVC-G5HV-48C6...

Write to immutable memory region in TensorFlow

Impact The tf.rawops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area: python import...

GHSA-HHVC-G5HV-48C6 Write to immutable memory region in TensorFlow

Impact The tf.rawops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area: python import...

accuinsight (>=1.0.47 <=1.0.61), alphad3m (>=0.10.0 <=0.10.0.dev1) +86 more potentially affected by CVE-2020-26267 via tensorflow (>=2.2.0 <=2.2.1)

tensorflow PYPI version =2.2.0, =1.0.47, =0.10.0, =0.5.0, =0.2.0, =0.0.6, =1.2.0, =1.0.0, =0.0.15, =0.0.16 and more Source cves: CVE-2020-26267 Source advisory: OSV:GHSA-C9F3-9WFR-WGH7...

accuinsight (>=1.0.62 <=3.0.0rc2), adapt-diagnostics (=1.2.0) +106 more potentially affected by CVE-2020-26266 via tensorflow (>=2.3.0 <=2.3.1)

tensorflow PYPI version =2.3.0, =1.0.62, =0.1.0, =0.0.1a0, =0.0.1, =1.0.0rc1, =20210206.0.0, =0.1.0.dev1, =0.2.4, =1.0.1.0, =1.0.3 - cardec-cite =1.1.0 and more Source cves: CVE-2020-26266 Source advisory: OSV:GHSA-QHXX-J73R-QPM2...

ai4bharat-transliteration (>=1.1.0 <=1.1.3), aipack (>=0.0.1 <=0.0.5) +53 more potentially affected by CVE-2020-26266 via tensorflow (>=2.0.0 <=2.0.3)

tensorflow PYPI version =2.0.0, =1.1.0, =0.0.1, =0.1.3.2, =0.2.6, =0.2.0, =0.0.2, =1.0.0.1, =0.0.1, =1.0.4, =0.6.0.post3, =0.1.3, =1.0.0, =1.0.1 and more Source cves: CVE-2020-26266 Source advisory: OSV:GHSA-QHXX-J73R-QPM2...