CVE-2022-41899: Improper Input Validation

TensorFlow is an open source platform for machine learning. Inputs densefeatures or examplestatedata not of rank 2 will trigger a CHECK fail in SdcaOptimizer. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will...

CVE-2022-41901: Improper Input Validation

TensorFlow is an open source platform for machine learning. An input sparsematrix that is not a matrix with a shape with rank 0 will trigger a CHECK fail in tf.rawops.SparseMatrixNNZ. We have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693. The fix will be included in...

CVE-2022-41899 `CHECK` fail via inputs in `SdcaOptimizer` in Tensorflow

TensorFlow is an open source platform for machine learning. Inputs densefeatures or examplestatedata not of rank 2 will trigger a CHECK fail in SdcaOptimizer. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will...

CVE-2022-41908: Improper Input Validation

TensorFlow is an open source platform for machine learning. An input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also...

CVE-2022-41899

TensorFlow is an open source platform for machine learning. Inputs "densefeatures" or "examplestatedata" not of rank 2 will trigger a "CHECK" fail in "SdcaOptimizer". We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. ...

CVE-2022-41901

TensorFlow is an open source platform for machine learning. An input "sparsematrix" that is not a matrix with a shape with rank 0 will trigger a "CHECK" fail in "tf.rawops.SparseMatrixNNZ". We have patched the issue in GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693. The fix will be includ...

CVE-2022-41908 `CHECK` fail via inputs in `PyFunc` in Tensorflow

TensorFlow is an open source platform for machine learning. An input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc. We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will also...

CVE-2022-41893: Reachable Assertion

TensorFlow is an open source platform for machine learning. If tf.rawops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56...

CVE-2022-41908

TensorFlow is an open source platform for machine learning. An input "token" that is not a UTF-8 bytestring will trigger a "CHECK" fail in "tf.rawops.PyFunc". We have patched the issue in GitHub commit 9f03a9d3bafe902c1e6beb105b2f24172f238645. The fix will be included in TensorFlow 2.11. We will...

Malicious code in test-inherited-attrs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f962e7dc884922f90141ffeaa6fce29bca1e10e59db0b32f2888ae1fdea2bd70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GSD-2022-1006672 wifi: mt76: mt7921e: fix random fw download fail

wifi: mt76: mt7921e: fix random fw download fail This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.6 by commit...

#bulkExecute() can reenter to steal funds

Lines of code Vulnerability details Impact ExchangebulkExecute can reenter, and internal execution of delegatecall is allowed to fail, not revert, malicious users can reenter to steal funds Proof of Concept Assumptions: There is a malicious user alice,with NFT for sale, paid through eth If user b...

Updated libtiff packages fix security vulnerability

There is a double free or corruption in rotateImage at tiffcrop.c:8839 found in libtiff 4.4.0rc1. CVE-2022-2519 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage at tiffcrop.c:8621 that can cause program crash when reading a crafted input. CVE-2022-2520 It w...

kernel: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback

In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dmsmregisterthresholdcallback Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dmpoolregistermetadatathreshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by...

Malicious code in bc-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d5617c26015681699f77459a3f1a44a8b19f0dcf78ed8228fc81852afb9a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-MCMR-49X3-4JQM ckb type_id script resume may randomly fail

Impact https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rsL871-L879 TypeIdSystemScript resume handle is not correct when maxcycles is not enough, ScriptError::ExceededMaximumCycles will be raised directly ranther than suspend as expect, and also because scriptgroup execution...

ckb type_id script resume may randomly fail

Impact https://github.com/nervosnetwork/ckb/blob/v0.101.2/script/src/verify.rsL871-L879 TypeIdSystemScript resume handle is not correct when maxcycles is not enough, ScriptError::ExceededMaximumCycles will be raised directly ranther than suspend as expect, and also because scriptgroup execution...

Malicious code in colorajs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d37f1e09d0b7641146be041d75d803d045e18fba41b5cc881ec1a3702fdc794e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nexthink/apollo-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2442bca6d9a3dd356ea5faa389a7389021876ef535ddd23ff709bb803655af2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in material-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ec41287cbcd54f97de58bebd79302854eab4c46d68300afdb5f1aeca9181df3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...