animl (>=1.1.2, <=1.1.4), arekit (>=0.21.0, <=0.22.1) +118 more potentially affected by CVE-2022-41886 via tensorflow-gpu (>=1.1.0, <=2.8.3)

tensorflow-gpu PYPI version =1.1.0, =1.1.2, =0.21.0, =0.23.0, =0.9.2, =0.0.1, =0.0.9, =0.1.0, =1.0.0, =0.2.1, =0.1.0, =0.1.2 - classitransformers 0.0.1 and more Source cves: CVE-2022-41886 Source advisory: MEND:CVE-2022-41886...

cifar-10-model (7.4.0), neuroutils (>=0.1.3, <=0.2.3) +1 more potentially affected by CVE-2022-41891 via tensorflow-cpu (2.10.0)

tensorflow-cpu PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - cifar-10-model 7.4.0 - neuroutils =0.1.3, =0.3.0.dev221212, =0.4.0.dev230202 Source cves: CVE-2022-41891 Source advisory:...

aadhaar-detection (0.5.0), abba-python (>=0.1.6, <=0.3.0) +1016 more potentially affected by CVE-2022-41897 via tensorflow (>=1.0.1, <=2.8.3)

tensorflow PYPI version =1.0.1, =0.1.6, =0.1.1, =1.0.1, =1.0.0, =6.0.0, =1.2.0, =1.1.2, =0.0.1, =0.3.26, =1.1.5, =1.3.2 and more Source cves: CVE-2022-41897 Source advisory: MEND:CVE-2022-41897...

cifar-10-model (7.4.0), neuroutils (>=0.1.3, <=0.2.3) +1 more potentially affected by CVE-2022-41886 via tensorflow-cpu (2.10.0)

tensorflow-cpu PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - cifar-10-model 7.4.0 - neuroutils =0.1.3, =0.3.0.dev221212, =0.4.0.dev230202 Source cves: CVE-2022-41886 Source advisory:...

c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), gamornet-cpu (>=0.2.3, <=0.4.3) +11 more potentially affected by CVE-2022-41909 via tensorflow-cpu (>=1.15.0, <=2.7.4)

tensorflow-cpu PYPI version =1.15.0, =0.1.0.dev1, =0.2.3, =0.1.2, =0.0.4, =1.5.0, =0.5.1, =0.102.0.dev0, =1.5.2, =0.7.0, =0.7.5 - tpu-tf2 1.0.0 Source cves: CVE-2022-41909 Source advisory: MEND:CVE-2022-41909...

cifar-10-model (7.4.0), neuroutils (>=0.1.3, <=0.2.3) +1 more potentially affected by CVE-2022-41899 via tensorflow-cpu (2.10.0)

tensorflow-cpu PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - cifar-10-model 7.4.0 - neuroutils =0.1.3, =0.3.0.dev221212, =0.4.0.dev230202 Source cves: CVE-2022-41899 Source advisory:...

a2grunnerp (>=0.1.0, <=0.1.8), aisdc (1.0.1) +43 more potentially affected by CVE-2022-41909 via tensorflow (2.10.0)

tensorflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - a2grunnerp =0.1.0, =0.1.1b2, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.7.0, =1.0.0 - cv2-group 0.2.0 - decimer-segmentation 1.1.1 and more Source...

aimodelshare (>=0.0.157, <=0.1.0), aliby (>=0.1.18, <=0.1.55) +76 more potentially affected by CVE-2022-41894 via tensorflow (>=2.9.0, <=2.9.2)

tensorflow PYPI version =2.9.0, =0.0.157, =0.1.18, =0.1.11, =0.30.0, =0.0.13, =0.1.0, =0.2.6, =0.0.1, =1.0.0, =1.1.0 and more Source cves: CVE-2022-41894 Source advisory: MEND:CVE-2022-41894...

CVE-2022-41888 Unckecked rank size in `tf.image.generate_bounding_box_proposals` in Tensorflow

TensorFlow is an open source platform for machine learning. When running on GPU, tf.image.generateboundingboxproposals receives a scores input that must be of rank 4 but is not checked. We have patched the issue in GitHub commit cf35502463a88ca7185a99daa7031df60b3c1c98. The fix will be included i...

aadhaar-detection (0.5.0), abba-python (>=0.1.6, <=0.3.0) +1016 more potentially affected by CVE-2022-41907 via tensorflow (>=1.0.1, <=2.8.3)

tensorflow PYPI version =1.0.1, =0.1.6, =0.1.1, =1.0.1, =1.0.0, =6.0.0, =1.2.0, =1.1.2, =0.0.1, =0.3.26, =1.1.5, =1.3.2 and more Source cves: CVE-2022-41907 Source advisory: MEND:CVE-2022-41907...

PT-2022-26112

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4 Description The issue occurs when the BaseCandidateSamplerOp function receives a value in true classes larger than range max, resulting in a heap out-of-bounds read...

CVE-2022-41886 Overflow in `ImageProjectiveTransformV2` in Tensorflow

TensorFlow is an open source platform for machine learning. When tf.rawops.ImageProjectiveTransformV2 is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The fix will be included in TensorFlow 2.11. We will also...

CVE-2022-41890 `CHECK` fail in `BCast` overflow in Tensorflow

TensorFlow is an open source platform for machine learning. If BCast::ToShape is given input larger than an int32, it will crash, despite being supposed to handle up to an int64. An example can be seen in tf.experimental.numpy.outer by passing in large input to the input b. We have patched the...

aggmap (>=1.1.1, <=1.2.1), molmap (>=1.3.1, <=1.4.0) potentially affected by CVE-2022-41888 via tensorflow-gpu (2.9.1)

tensorflow-gpu PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - aggmap =1.1.1, =1.3.1, =1.4.0 Source cves: CVE-2022-41888 Source advisory: MEND:CVE-2022-41888...

animl (>=1.1.2, <=1.1.4), arekit (>=0.21.0, <=0.22.1) +118 more potentially affected by CVE-2022-41911 via tensorflow-gpu (>=1.1.0, <=2.8.3)

tensorflow-gpu PYPI version =1.1.0, =1.1.2, =0.21.0, =0.23.0, =0.9.2, =0.0.1, =0.0.9, =0.1.0, =1.0.0, =0.2.1, =0.1.0, =0.1.2 - classitransformers 0.0.1 and more Source cves: CVE-2022-41911 Source advisory: MEND:CVE-2022-41911...

aimodelshare (>=0.0.157, <=0.1.0), aliby (>=0.1.18, <=0.1.55) +76 more potentially affected by CVE-2022-41908 via tensorflow (>=2.9.0, <=2.9.2)

tensorflow PYPI version =2.9.0, =0.0.157, =0.1.18, =0.1.11, =0.30.0, =0.0.13, =0.1.0, =0.2.6, =0.0.1, =1.0.0, =1.1.0 and more Source cves: CVE-2022-41908 Source advisory: MEND:CVE-2022-41908...

CVE-2022-41911

TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a "const char" array since that's the underlying storage and then we typecast it to the element type. However, conversions from "char" to "bool" are undefined if the "char" is not "0" or "1", s...

CVE-2022-41880

TensorFlow is an open source platform for machine learning. When the "BaseCandidateSamplerOp" function receives a value in "trueclasses" larger than "rangemax", a heap oob read occurs. We have patched the issue in GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. The fix will be included in...

CVE-2022-41885

TensorFlow is an open source platform for machine learning. When "tf.rawops.FusedResizeAndPadConv2D" is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypi...

CVE-2022-41894 Buffer overflow in `CONV_3D_TRANSPOSE` on TFLite

TensorFlow is an open source platform for machine learning. The reference kernel of the CONV3DTRANSPOSE TensorFlow Lite operator wrongly increments the dataptr when adding the bias to the result. Instead of dataptr += numchannels; it should be dataptr += outputnumchannels; as if the number of inp...