GHSA-2GFX-95X2-5V3X Heap buffer overflow in `QuantizedReshape`

Impact An attacker can cause a heap buffer overflow in QuantizedReshape by passing in invalid thresholds for the quantization: python import tensorflow as tf tensor = tf.constant, dtype=tf.qint32 shape = tf.constant, dtype=tf.int32 inputmin = tf.constant, dtype=tf.float32 inputmax = tf.constant,...

GHSA-M3F9-W3P3-P669 Heap buffer overflow in `QuantizedMul`

Impact An attacker can cause a heap buffer overflow in QuantizedMul by passing in invalid thresholds for the quantization: python import tensorflow as tf x = tf.constant256, 328, shape=1, 2, dtype=tf.quint8 y = tf.constant256, 328, shape=1, 2, dtype=tf.quint8 minx = tf.constant, dtype=tf.float32...

GHSA-393F-2JR3-CP69 CHECK-fail in DrawBoundingBoxes

Impact An attacker can trigger a denial of service via a CHECK failure by passing an empty image to tf.rawops.DrawBoundingBoxes: python import tensorflow as tf images = tf.fill53, 0, 48, 1, 0. boxes = tf.fill53, 31, 4, 0. boxes = tf.Variableboxes boxes0, 0, 0.assign3.90621...

GHSA-3QXP-QJQ7-W4HF CHECK-fail in tf.raw_ops.EncodePng

Impact An attacker can trigger a CHECK fail in PNG encoding by providing an empty input tensor as the pixel data: python import tensorflow as tf image = tf.zeros0, 0, 3 image = tf.castimage, dtype=tf.uint8 tf.rawops.EncodePngimage=image This is because the implementation only validates that the...

GHSA-C968-PQ7H-7FXV Division by 0 in `Conv3DBackprop*`

Impact The tf.rawops.Conv3DBackprop operations fail to validate that the input tensors are not empty. In turn, this would result in a division by 0: python import tensorflow as tf inputsizes = tf.constant0, 0, 0, 0, 0, shape=5, dtype=tf.int32 filtertensor = tf.constant, shape=0, 0, 0, 1, 0,...

GHSA-84MW-34W6-2Q43 Null pointer dereference via invalid Ragged Tensors

Impact Calling tf.rawops.RaggedTensorToVariant with arguments specifying an invalid ragged tensor results in a null pointer dereference: python import tensorflow as tf inputtensor = tf.constant, shape=0, 0, 0, 0, 0, dtype=tf.float32 filtertensor = tf.constant, shape=0, 0, 0, 0, 0, dtype=tf.float3...

CVE-2021-29258

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion...

PT-2021-18151 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy version 1.14.0 Description: An issue was discovered that allows for a remotely exploitable crash for HTTP2 Metadata. This occurs because an empty METADATA map triggers a Reachable Assertion. Recommendations: For Envoy version 1.14.0, at...

jwt-go: access restriction bypass vulnerability

A vulnerability was found in jwt-go where it is vulnerable to Access Restriction Bypass if m"aud" happens to be string, as allowed by the spec, the type assertion fails and the value of aud is "". This can cause audience verification to succeed even if the audiences being passed are incorrect if...

libredwg:llvmfuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5592380058238976 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerubsanlibredwg Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x000002da7a30 Crash State: NULL Sanitizer: undefined UBSAN Recommende...

libyang: double-free in function yyparse() when empty description is used

A double-free flaw occurs in libyang in function yyparse when an empty description is used. Applications that use libyang to process untrusted input YANG files may be vulnerable to this flaw, possibly causing a crash or potential code execution...

TensorFlow Denial of Service Vulnerability (CNVD-2021-36542)

Google TensorFlow is an end-to-end open source machine learning platform. A denial of service vulnerability exists in TensorFlow. An attacker can exploit this vulnerability by passing empty images to tf.rawops.DrawBoundingBoxes to cause a CHECK failure denial of service...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service. A NULL pointer dereference occurs in MatrixDiag ops as the implementation does not validate that the tensor arguments are non-empty...

CVE-2021-29565

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a null pointer dereference in the implementation of tf.rawops.SparseFillEmptyRows. This is because of missing...

CVE-2021-29533

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a CHECK failure by passing an empty image to tf.rawops.DrawBoundingBoxes. This is because the...

PYSEC-2021-497

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...

PYSEC-2021-678

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by controlling the values of numsegments tensor argument for UnsortedSegmentJoin. This is because the...

PYSEC-2021-661

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in QuantizedMul by passing in invalid thresholds for the quantization. This is because the...

CVE-2021-29590

TensorFlow is an end-to-end open source platform for machine learning. The implementations of the Minimum and Maximum TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty. This is because the broadcasting...

PYSEC-2021-205

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in tf.rawops.ParameterizedTruncatedNormal. This is because the...