BIT-TENSORFLOW-2022-23581 `CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that IsSimplifiableReshape would trigger CHECK failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this...

BIT-TENSORFLOW-2022-23582 `CHECK`-failures in `TensorByteSize` in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that TensorByteSize would trigger CHECK failures. TensorShape constructor throws a CHECK-fail if shape is partial or has a number of elements that would overflow t...

BIT-TENSORFLOW-2022-23583 `CHECK`-failures in binary ops in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer...

BIT-TENSORFLOW-2022-29210 Heap buffer overflow due to incorrect hash function in TensorFlow

TensorFlow is an open source platform for machine learning. In version 2.8.0, the TensorKey hash function used total estimated AllocatedBytes, which a is an estimate per tensor, and b is a very poor hash function for constants e.g. int32t. It also tried to access individual tensor bytes through...

The vulnerability of the kvm_io_bus_unregister_dev() function in the KVM subsystem of Linux operating systems allows a attacker to cause a service failure.

The vulnerability of the kvmiobusunregisterdev function in the KVM subsystem of Linux operating systems is related to errors in pointer assignment during device registration. Exploiting this vulnerability can allow an attacker to cause system failures...

The vulnerability of the DNS server service in Windows operating systems allows a perpetrator to disclose protected information or cause service failures.

The vulnerability of the DNS server service in Windows operating systems is related to the lack of protection for service-related data. Exploiting this vulnerability can allow a attacker to disclose sensitive information or cause service failures...

The vulnerability of the cJSON_InsertItemInArray function in the JSON file processing library for the C JSON-C language allows a attacker to cause a service failure.

The vulnerability of the cJSONInsertItemInArray function in the JSON file processing library for the C JSON language is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

CVE-2021-47076

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Return CQE error if invalid lkey was supplied RXE is missing update of WQE status in LOCALWRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. leonro@...

CentOS 9 : bind-9.16.23-9.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the bind-9.16.23-9.el9 build changelog. - Sending a flood of dynamic DNS updates may cause named to allocate large amounts of memory. This, in turn, may cause named to exit due to ...

The vulnerability of the site isolation function in Microsoft Edge and Google Chrome browsers allows a malicious actor to gain unauthorized access to protected information or cause service failures.

The vulnerability of site isolation functions in Microsoft Edge and Google Chrome browsers is related to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

WordPress JobSearch Plugin < 2.3.4 is vulnerable to Broken Authentication

Software JobSearch Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2023-6584 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f4a18b4236e5 Credits Marc Montpas...

The vulnerability of the Manageability Engine (ME) in Intel Server Platform Services (SPS) software for Lenovo ThinkSystem servers allows a malicious actor to alter the firmware configuration and trigger a service failure.

The vulnerability of the Manageability Engine ME in Intel Server Platform Services SPS of Lenovo ThinkSystem servers stems from the synchronization failure between BIOS/UEFI and ME states due to the use of non-replicable configurations. Exploiting this vulnerability can allow an attacker to alter...

The vulnerability of the Django web application platform, related to uncontrolled resource consumption, allows attackers to trigger service failures.

The vulnerability of the Django web application framework is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of Intel Server Platform Services’ microprogramming software, related to uncontrolled resource consumption, allows a perpetrator to trigger a service failure.

The vulnerability of Intel Server Platform Services’ microprogramming software is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of microprogrammed software in Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs is caused by deficiencies in the authentication process, which allows unauthorized access to confidential information or causes service failures.

The vulnerability of microprogrammed software in Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs is related to deficiencies in the authentication process. Exploiting this vulnerability can allow unauthorized individuals to access confidential information or cause service failures...

The vulnerability of the Intel Memory and Storage Tool’s software for monitoring and managing RAM and solid-state drives lies in improper resource initialization, which allows a hacker to trigger a service failure.

The vulnerability of the Intel Optane solid-state storage management tool for customers and data processing centers involves improper initialization of resources. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the sshpk library on the Node.js software platform, which allows a hacker to cause a service failure.

The vulnerability of the sshpk library on the Node.js software platform is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA flow gas analyzers is related to deficiencies in authentication procedures. This allows attackers to compromise data integrity and cause service failures.

The vulnerability of the microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA gas analyzers is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to compromise data integrity and cause service failures...

The vulnerability of the Suricata intrusion detection and prevention system, due to the unlimited distribution of resources, allows an intruder to trigger a service failure.

The vulnerability of the Suricata intrusion detection and prevention system is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

ISC BIND Security Vulnerability

ISC BIND is a suite of open source software that implements the DNS protocol from the US company ISC. A security vulnerability exists in ISC BIND that stems from the presence of bad interactions that could lead to assertion failures...