QEMU 数字错误漏洞

QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. A code issue vulnerability exists in QEMU, which stems from a found a division by zero issue in the dwc2handlepacket handler package in the...

Denial Of Service (DoS)

imagemagick is vulnerable to denial of service. The vulnerability exists due to a division by zero in WaveImage of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick...

Denial Of Service (DoS)

imagemagick:edge is vulnerable to denial of service. A division by zero ConvertXYZToJzazbz of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick...

OESA-2021-1198 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

GHSA-8RM6-75MF-7R7R Division by zero in TFLite's implementation of hashtable lookup

Impact The TFLite implementation of hashtable lookup is vulnerable to a division by zero error: cc const int numrows = SizeOfDimensionvalue, 0; const int rowbytes = value-bytes / numrows; An attacker can craft a model such that values's first dimension would be 0. Patches We have patched the issu...

GHSA-RF3H-XGV5-2Q39 Division by zero in TFLite's implementation of `DepthwiseConv`

Impact The implementation of the DepthwiseConv TFLite operator is vulnerable to a division by zero error: cc int numinputchannels = SizeOfDimensioninput, 3; TFLITEENSUREEQcontext, numfilterchannels % numinputchannels, 0; An attacker can craft a model such that input's fourth dimension would be 0...

Division by zero in TFLite's implementation of `DepthwiseConv`

Impact The implementation of the DepthwiseConv TFLite operator is vulnerable to a division by zero error: cc int numinputchannels = SizeOfDimensioninput, 3; TFLITEENSUREEQcontext, numfilterchannels % numinputchannels, 0; An attacker can craft a model such that input's fourth dimension would be 0...

GHSA-J8QH-3XRQ-C825 Division by zero in TFLite's implementation of `OneHot`

Impact The implementation of the OneHot TFLite operator is vulnerable to a division by zero error: cc int prefixdimsize = 1; for int i = 0; i dims-datai; const int suffixdimsize = NumElementsopcontext.indices / prefixdimsize; An attacker can craft a model such that at least one of the dimensions ...

Division by zero in TFLite's implementation of `OneHot`

Impact The implementation of the OneHot TFLite operator is vulnerable to a division by zero error: cc int prefixdimsize = 1; for int i = 0; i dims-datai; const int suffixdimsize = NumElementsopcontext.indices / prefixdimsize; An attacker can craft a model such that at least one of the dimensions ...

GHSA-97WF-P777-86JQ Division by zero in TFLite's implementation of Split

Impact The implementation of the Split TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREMSGcontext, inputsize % numsplits == 0, "Not an even split"; const int slicesize = inputsize / numsplits; An attacker can craft a model such that numsplits would be 0. Patches We have...

Division by zero in TFLite's implementation of Split

Impact The implementation of the Split TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREMSGcontext, inputsize % numsplits == 0, "Not an even split"; const int slicesize = inputsize / numsplits; An attacker can craft a model such that numsplits would be 0. Patches We have...

Division by zero in TFLite's implementation of `SVDF`

Impact The implementation of the SVDF TFLite operator is vulnerable to a division by zero error: cc const int rank = params-rank; ... TFLITEENSUREEQcontext, numfilters % rank, 0; An attacker can craft a model such that params-rank would be 0. Patches We have patched the issue in GitHub commit...

GHSA-V52P-HFJF-WG88 Division by zero in TFLite's implementation of `SpaceToBatchNd`

Impact The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREEQcontext, finaldimsize % blockshapedim, 0; outputsize-datadim + 1 = finaldimsize / blockshapedim; An attacker can craft a model such that one dimension of the block input is ...

Division by zero in TFLite's implementation of `SpaceToBatchNd`

Impact The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREEQcontext, finaldimsize % blockshapedim, 0; outputsize-datadim + 1 = finaldimsize / blockshapedim; An attacker can craft a model such that one dimension of the block input is ...

GHSA-4VRF-FF7V-HPGR Division by zero in TFLite's implementation of `EmbeddingLookup`

The implementation of the EmbeddingLookup TFLite operator is vulnerable to a division by zero error: cc const int rowsize = SizeOfDimensionvalue, 0; const int rowbytes = value-bytes / rowsize; An attacker can craft a model such that the first dimension of the value input is 0. Patches We have...

Division by zero in TFLite's implementation of `EmbeddingLookup`

The implementation of the EmbeddingLookup TFLite operator is vulnerable to a division by zero error: cc const int rowsize = SizeOfDimensionvalue, 0; const int rowbytes = value-bytes / rowsize; An attacker can craft a model such that the first dimension of the value input is 0. Patches We have...

GHSA-VF94-36G5-69V8 Division by zero in TFLite's implementation of `DepthToSpace`

Impact The implementation of the DepthToSpace TFLite operator is vulnerable to a division by zero error: cc const int blocksize = params-blocksize; ... const int inputchannels = input-dims-data3; ... int outputchannels = inputchannels / blocksize / blocksize; An attacker can craft a model such th...

Division by zero in TFLite's implementation of `DepthToSpace`

Impact The implementation of the DepthToSpace TFLite operator is vulnerable to a division by zero error: cc const int blocksize = params-blocksize; ... const int inputchannels = input-dims-data3; ... int outputchannels = inputchannels / blocksize / blocksize; An attacker can craft a model such th...

GHSA-3QGW-P4FM-X7GF Division by zero in TFLite's convolution code

Impact TFLite's convolution code has multiple division where the divisor is controlled by the user and not checked to be non-zero. For example: cc const int inputsize = NumElementsinput / SizeOfDimensioninput, 0; Patches We have patched the issue in GitHub commit...

GHSA-CFX7-2XPC-8W4H Division by zero in TFLite's implementation of `BatchToSpaceNd`

Impact The implementation of the BatchToSpaceNd TFLite operator is vulnerable to a division by zero error: cc TFLITEENSUREEQcontext, outputbatchsize % blockshapedim, 0; outputbatchsize = outputbatchsize / blockshapedim; An attacker can craft a model such that one dimension of the block input is 0...