CVE-2022-41908: Improper Input Validation

TensorFlow is an open source platform for machine learning. An input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also...

CVE-2022-41893 `CHECK_EQ` fail in `tf.raw_ops.TensorListResize` in Tensorflow

TensorFlow is an open source platform for machine learning. If tf.rawops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56...

CVE-2022-41887

TensorFlow is an open source platform for machine learning. "tf.keras.losses.poisson" receives a "ypred" and "ytrue" that are passed through "functor::mul" in "BinaryOp". If the resulting dimensions overflow an "int32", TensorFlow will crash due to a size mismatch during broadcast assignment. We...

CVE-2022-41888

TensorFlow is an open source platform for machine learning. When running on GPU, "tf.image.generateboundingboxproposals" receives a "scores" input that must be of rank 4 but is not checked. We have patched the issue in GitHub commit cf35502463a88ca7185a99daa7031df60b3c1c98. The fix will be includ...

PT-2022-26117

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4 Description TensorFlow is an open source platform for machine learning. When tf.raw ops.ImageProjectiveTransformV2 is given a large output shape, it overflows. The...

a2grunnerp (>=0.1.0, <=0.1.8), aisdc (1.0.1) +43 more potentially affected by CVE-2022-41891 via tensorflow (2.10.0)

tensorflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - a2grunnerp =0.1.0, =0.1.1b2, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.7.0, =1.0.0 - cv2-group 0.2.0 - decimer-segmentation 1.1.1 and more Source...

c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), gamornet-cpu (>=0.2.3, <=0.4.3) +11 more potentially affected by CVE-2022-41886 via tensorflow-cpu (>=1.15.0, <=2.7.4)

tensorflow-cpu PYPI version =1.15.0, =0.1.0.dev1, =0.2.3, =0.1.2, =0.0.4, =1.5.0, =0.5.1, =0.102.0.dev0, =1.5.2, =0.7.0, =0.7.5 - tpu-tf2 1.0.0 Source cves: CVE-2022-41886 Source advisory: MEND:CVE-2022-41886...

a2grunnerp (>=0.1.0, <=0.1.8), aisdc (1.0.1) +43 more potentially affected by CVE-2022-41889 via tensorflow (2.10.0)

tensorflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - a2grunnerp =0.1.0, =0.1.1b2, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.7.0, =1.0.0 - cv2-group 0.2.0 - decimer-segmentation 1.1.1 and more Source...

animl (>=1.1.2, <=1.1.4), arekit (>=0.21.0, <=0.22.1) +118 more potentially affected by CVE-2022-41898 via tensorflow-gpu (>=1.1.0, <=2.8.3)

tensorflow-gpu PYPI version =1.1.0, =1.1.2, =0.21.0, =0.23.0, =0.9.2, =0.0.1, =0.0.9, =0.1.0, =1.0.0, =0.2.1, =0.1.0, =0.1.2 - classitransformers 0.0.1 and more Source cves: CVE-2022-41898 Source advisory: MEND:CVE-2022-41898...

CVE-2022-41885

TensorFlow vulnerability CVE-2022-41885 affects tf.raw_ops.FusedResizeAndPadConv2D when handling large tensor shapes, causing a buffer/overflow. A fix was committed (d66e1d568275e6a2947de97dca7a102a211e01ce) and will be included in TensorFlow 2.11. TensorFlow team will cherry-pick this commit to ...

CVE-2022-41907 Overflow in `ResizeNearestNeighborGrad` in Tensorflow

TensorFlow is an open source platform for machine learning. When tf.rawops.ResizeNearestNeighborGrad is given a large size input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The fix will be included in TensorFlow 2.11. We will also cherrypick...

CVE-2022-41907

TensorFlow is an open source platform for machine learning. When "tf.rawops.ResizeNearestNeighborGrad" is given a large "size" input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The fix will be included in TensorFlow 2.11. We will also...

cifar-10-model (7.4.0), neuroutils (>=0.1.3, <=0.2.3) +1 more potentially affected by CVE-2022-41909 via tensorflow-cpu (2.10.0)

tensorflow-cpu PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - cifar-10-model 7.4.0 - neuroutils =0.1.3, =0.3.0.dev221212, =0.4.0.dev230202 Source cves: CVE-2022-41909 Source advisory:...

CVE-2022-41909

CVE-2022-41909 affects TensorFlow: an input encoded that is not a valid CompositeTensorVariant can cause a segfault in tf.raw_ops.CompositeTensorVariantToComponents. Patches are in commits bf594d08d... and 660ce5a89e..., with the fix slated for TensorFlow 2.11 and cherry-picked to 2.10.1, 2.9.3, ...

aadhaar-detection (0.5.0), abba-python (>=0.1.6, <=0.3.0) +1016 more potentially affected by CVE-2022-41893 via tensorflow (>=1.0.1, <=2.8.3)

tensorflow PYPI version =1.0.1, =0.1.6, =0.1.1, =1.0.1, =1.0.0, =6.0.0, =1.2.0, =1.1.2, =0.0.1, =0.3.26, =1.1.5, =1.3.2 and more Source cves: CVE-2022-41893 Source advisory: MEND:CVE-2022-41893...

CVE-2022-41898

TensorFlow CVE-2022-41898 causes a crash when SparseFillEmptyRowsGrad is given empty inputs. The issue was patched in commit af4a6a3c8b95022c351edae94560acc61253a1b8 and will be included in TensorFlow 2.11; the patch will also be cherry-picked to 2.10.1, 2.9.3, and 2.8.4, which are within the sup...

aimodelshare (>=0.0.157, <=0.1.0), aliby (>=0.1.18, <=0.1.55) +76 more potentially affected by CVE-2022-41886 via tensorflow (>=2.9.0, <=2.9.2)

tensorflow PYPI version =2.9.0, =0.0.157, =0.1.18, =0.1.11, =0.30.0, =0.0.13, =0.1.0, =0.2.6, =0.0.1, =1.0.0, =1.1.0 and more Source cves: CVE-2022-41886 Source advisory: MEND:CVE-2022-41886...

cifar-10-model (7.4.0), neuroutils (>=0.1.3, <=0.2.3) +1 more potentially affected by CVE-2022-41901 via tensorflow-cpu (2.10.0)

tensorflow-cpu PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - cifar-10-model 7.4.0 - neuroutils =0.1.3, =0.3.0.dev221212, =0.4.0.dev230202 Source cves: CVE-2022-41901 Source advisory:...

Google TensorFlow buffer error vulnerability

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A security vulnerability exists in Google TensorFlow that causes FractionalMaxAVG Pool to have an illegal poolingratio. attackers using Tensorflow can exploit this vulnerability. They can access heap...

a2grunnerp (>=0.1.0, <=0.1.8), aisdc (1.0.1) +43 more potentially affected by CVE-2022-41900 via tensorflow (2.10.0)

tensorflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - a2grunnerp =0.1.0, =0.1.1b2, =1.0.0, =0.1.0, =0.1.3, =1.0.0, =0.7.0, =1.0.0 - cv2-group 0.2.0 - decimer-segmentation 1.1.1 and more Source...