CVE-2022-35971: Reachable Assertion

TensorFlow is an open source platform for machine learning. If FakeQuantWithMinMaxVars is given min or max tensors of a nonzero rank, it results in a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...

CVE-2022-35987: Reachable Assertion

TensorFlow is an open source platform for machine learning. DenseBincount assumes its input tensor weights to either have the same shape as its input tensor input or to be length-0. A different weights shape will trigger a CHECK fail that can be used to trigger a denial of service attack. We have...

CVE-2022-35998: Reachable Assertion

TensorFlow is an open source platform for machine learning. If EmptyTensorList receives an input elementshape with more than one dimension, it gives a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...

CVE-2022-36004: Reachable Assertion

TensorFlow is an open source platform for machine learning. When tf.random.gamma receives large input shape and rates, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 552bfced6ce4809db5f3ca305f60ff80dd40c5a3. The fix will be included i...

CVE-2022-36002: Reachable Assertion

TensorFlow is an open source platform for machine learning. When Unbatch receives a nonscalar input id, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 4419d10d576adefa36b0e0a9425d2569f7c0189f. The fix will be included in TensorFlow...

CVE-2022-36001: Reachable Assertion

TensorFlow is an open source platform for machine learning. When DrawBoundingBoxes receives an input boxes that is not of dtype float, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit da0d65cdc1270038e72157ba35bf74b85d9bda11. The fix wi...

Malicious code in internallib_v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e20f2dbd6f9f998c845fcea1c346d6b4126be9f906c2aeaaebe8e074e374193 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v340 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43570bd043aa581a3eeb3e0fa059e89cbdd9eb7be6e3e3c531c90f5d71dca94b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in h3-jsv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e53007d84b93b71d7e615edf57ba81b6ef6e5fcdf194395afdf4bdf9ca5f9b69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wix-bi-logger-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1e185d8229566fd434ef411f0f422b917f946846f53e3b81e0f5c37b3dcb0d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-2520: Incorrect Calculation of Buffer Size

A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage at tiffcrop.c:8621 that can cause program crash when reading a crafted input...

How to Support Agile Development Through Cybersecurity Best Practices

Understanding other peoples problems It’s often said that people only notice cybersecurity when it fails, or when it gets in the way of them doing their jobs. Organizations, and especially software development teams, want to be able to develop quickly and easily to stay ahead of their competition...

Malicious code in moble (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a35bb142aed74f7cfea86a6521b14e1e7bd9360768f84540d9eddebb1936100 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-2978

A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function securityinodealloc to fail with following call to function nilfsmdtdestroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

Malicious code in ve-loaer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f591aa173fa95037c0279b301e3fe1d86b8db7b3165221944fb20fd10021e7ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in t-simp8e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 998af0f58c4ebd6ef92372fd8ef84c2ae7cce4e266d422e8da10a0bdef3dcab9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tdype-si (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22f1742907d020815614e7d74137913a2586d84e6b922f311dcb861ee3d6891e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03f3abafda4f4131063df3e9fe185f14b537d5e9bbd26b9cff29d7431050ecd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tsli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60b8416865ad08ddda76adb4f99ff655446bd2c36dab5be8e691371123d59a76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in senbg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 816f8a3dd23dcccba9df7537df01bcad9933c5c74a1b26412f3520caa25bd6f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...