Google TensorFlow code issues and vulnerabilities

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A code issue vulnerability exists in Google TensorFlow, which stems from the fact that if an empty sortedinputs input is provided for a LowerBound or UpperBound, it can cause nullptr dereference, an...

Google TensorFlow code issues and vulnerabilities

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. Google TensorFlow suffers from a code issue vulnerability that stems from the fact that it crashes when mlir::tfg::TFOp::nameAttr receives an empty type list attribute. Th...

CVE-2022-36012: Reachable Assertion

TensorFlow is an open source platform for machine learning. When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it crashes. We have patched the issue in GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b. The fix will be included in TensorFlow 2.10.0. We wi...

CVE-2022-36011: NULL Pointer Dereference

TensorFlow is an open source platform for machine learning. When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b. The fix will be included in...

CVE-2022-36000: NULL Pointer Dereference

TensorFlow is an open source platform for machine learning. When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit aed36912609fc07229b4d0a7b44f3f48efc00fd0. The fix will be included in...

PT-2022-23099

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue arises when mlir::tfg::ConvertGenericFunctionToFunctionDef is given emp...

PT-2022-23111

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue occurs when the mlir::tfg::ConvertGenericFunctionToFunctionDef function...

PT-2022-23084

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1, 2.8.1, and 2.7.2 Description The issue occurs when RaggedBincount is given an empty input tensor splits, resulting in a segfault that can be used to trigger a denial of service...

PT-2022-23096

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue arises when EmptyTensorList receives an input element shape with more...

config-validator:fuzz_config_validator: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4860468560265216 Project: config-validator Fuzzing Engine: libFuzzer Fuzz Target: fuzzconfigvalidator Job Type: libfuzzerasanconfig-validator Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL...

Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Summary Security vulnerabilities have been reported for IBM SDK for Node.js. IBM Business Automation Workflow and IBM BPM include a stand-alone tool for editing configuration properties files that is based on IBM SDK for Node.js. Vulnerability Details CVEID: CVE-2019-9517 DESCRIPTION: Multiple...

BELL-CVE-2022-2905 CVE-2022-2905 does not affect BellSoft software

Bulletin has no description...

hsqldb:SqlPreparedStatementFuzzer: Security exception with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5357744118431744 Project: hsqldb Fuzzing Engine: libFuzzer Fuzz Target: SqlPreparedStatementFuzzer Job Type: libfuzzerasanhsqldb Platform Id: linux Crash Type: Security exception Crash Address: Crash State: NULL Sanitizer: address ASAN Recommende...

openyurt:fuzz_yurtappdaemon_controller: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4606113399570432 Project: openyurt Fuzzing Engine: libFuzzer Fuzz Target: fuzzyurtappdaemoncontroller Job Type: libfuzzerasanopenyurt Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN...

ngolo-fuzzing:fuzz_ng_math_big: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6424608265338880 Project: ngolo-fuzzing Fuzzing Engine: libFuzzer Fuzz Target: fuzzngmathbig Job Type: libfuzzerasanngolo-fuzzing Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer:...

DEBIAN-CVE-2022-31152

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including...

PYSEC-2022-262

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of event authorization rules which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including...

burntsushi-toml:fuzz_toml: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5795622468321280 Project: burntsushi-toml Fuzzing Engine: libFuzzer Fuzz Target: fuzztoml Job Type: libfuzzerasanburntsushi-toml Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000ae23ac9 Crash State: NULL Sanitizer: address ASAN...

CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...

CVE-2022-37397

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password...