OSV-2021-449 UNKNOWN READ in std::pair<absl::lts_NUMBER_02_25::container_internal::raw_hash_set<absl::lts_NUM

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31393 Crash type: UNKNOWN READ Crash state: std::pair::Compute tensorflow::KernelAndDeviceOp::Run...

Security Bulletin: TensorFlow in Watson Machine Learning Community Edition 1.6.2 and 1.7.0 has been patched for various security issues.

Summary TensorFlow in Watson Machine Learning Community Edition 1.6.2 and 1.7.0 has had various CVE reported against it and have been patched. Users should update to the latest available TensorFlow package. Vulnerability Details CVEID: CVE-2020-15265 DESCRIPTION: Tensorflow is vulnerable to a...

Security Bulletin: TensorFlow in Watson Machine Learning 1.6.2 and 1.7.0 has been patched for various security issues in nanopb.

Summary TensorFlow in Watson Machine Learning 1.6.2 and 1.7.0 has had various secuirty issue published for nanopb. These have been patched in the latest versions of TensorFlow. Vulnerability Details Third Party Entry: 193026 DESCRIPTION: Nanopb pbencode buffer overflow CVSS Base score: 4.8 CVSS...

Security Bulletin: TensorFlow in Watson Machine Learning 1.6.2 and 1.7.0 has been patched for a security issue in nanopb.

Summary TensorFlow in Watson Machine Learning 1.6.2 and 1.7.0 has had various secuirty issue published for nanopb. These have been patched in the latest versions of TensorFlow. Vulnerability Details CVEID: CVE-2020-26243 DESCRIPTION: Nanopb is vulnerable to a denial of service, caused by a memory...

Security Bulletin: TensorFlow in Watson Machine Learning Community Edition 1.6.2 and 1.7.0 has been patched for various security issues.

Summary TensorFlow in Watson Machine Learning Community Edition 1.6.2 and 1.7.0 has had various reported CVEID's included below. These issues have been patched and users should update to the latest available versions. Vulnerability Details CVEID: CVE-2020-26270 DESCRIPTION: TensorFlow is vulnerab...

Code Injection in tensorflow/tfx

Description TensorFlow Extended TFX is a Google-production-scale machine learning platform based on TensorFlow. It provides a configuration framework to express ML pipelines consisting of TFX components. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of...

Code Injection in tensorlayer/tensorlayer

Description TensorLayer is a novel TensorFlow-based deep learning and reinforcement learning library designed for researchers and engineers. It provides an extensive collection of customizable neural layers to build advanced AI models quickly. This package is vulnerable to Arbitrary Code Executio...

Code Injection in uber/petastorm

Description Petastorm is an open source data access library developed at Uber ATG. This library enables single machine or distributed training and evaluation of deep learning models directly from datasets in Apache Parquet format. Petastorm supports popular Python-based machine learning ML...

Code Injection in tensorflow/models

Description Arbitrary Code Excecution in Tensorflow/Models.The TensorFlow Model Garden is a repository with a number of different implementations of state-of-the-art SOTA models and modeling solutions for TensorFlow users. We aim to demonstrate the best practices for modeling so that TensorFlow...

[ASA-202012-22] tensorflow: multiple issues

Arch Linux Security Advisory ASA-202012-22 ========================================== Severity: Critical Date : 2020-12-16 CVE-ID : CVE-2020-26266 CVE-2020-26267 CVE-2020-26268 CVE-2020-26269 CVE-2020-26270 CVE-2020-26271 Package : tensorflow Type : multiple issues Remote : No Link :...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-00089)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow has a security vulnerability that can be exploited by an attacker to access a special directory...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-00091)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a buffer overflow vulnerability that stems from the DataFormatVecPermute API not validating the src format and dst format attributes. An attacker could exploit the...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-00092)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. TensorFlow suffers from a buffer overflow vulnerability that can be exploited by an attacker to leak addresses from the library...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-00090)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a buffer overflow vulnerability that can be exploited by an attacker to cause a buffer overflow...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service DoS. The vulnerability exists as the function GetMatchingPaths for matching filesystem paths to globbing pattern crashes the application by causing the out of bounds read...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service DoS. The vulnerability exists as the tf.rawops.ImmutableConst operation crashes the Python interpreter when it tries to write the immutable memory area, if the type of the tensor is not an integral type...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. A CHECK-fail in LSTM allows an attacker to crash the application with a zero-length input...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. A unauthorized write to immutable memory region results in a segmentation fault and an application crash...

Arbitrary Code Execution

tensorflow is vulnerable to arbitrary code execution. An attacker is able to execute arbitrary code on the host OS via a saved model by triggering the use of uninitialized values during code execution...

Information Disclosure

tensorflow is vulnerable to information disclosure. A heap out-of-bounds read in MakeEdge allows an attacker to leak address and potentially obtain confidential information...