CVE-2022-35990

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

GHSA-R26C-679W-MRJM TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsGradient`

Impact When tf.quantization.fakequantwithminmaxvarsgradient receives input min or max that is nonscalar, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf import numpy as np arg0=tf.constantvalue=np.random.randomsize=2, 2, shape=2, 2, dtype=tf.float...

GHSA-9J4V-PP28-MXV7 TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel`

Impact If FakeQuantWithMinMaxVarsPerChannel is given min or max tensors of a rank other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf numbits = 8 narrowrange = False inputs = tf.constant0, shape=4, dtype=tf.float32 min ...

CVE-2022-35973

TensorFlow is an open source platform for machine learning. If QuantizedMatMul is given nonscalar input for: mina, maxa, minb, or maxb It gives a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit aca766ac7693bf29ed0df55ad6bfcc78f35e7f48. T...

PT-2022-23073

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description TensorFlow is an open source platform for machine learning. If...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google Inc. in the United States. A security vulnerability exists in Google TensorFlow, which stems from the fact that when tf.quantization.fakequantwithminmaxvarsgradient receives non-scalar inputs min or...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google Inc. in the United States. Google TensorFlow suffers from a security vulnerability that stems from the fact that when tf.quantization.fakequantwithminmaxvarsperchannelgradient receives an input min o...

PT-2022-23088

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier Description The issue occurs when tf.quantization.fake quant with min max vars per channel...

PT-2022-23070

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1, 2.8.1, and 2.7.2 Description The issue arises when FakeQuantWithMinMaxVars is given min or max tensors of a nonzero rank, resulting in a CHECK fail that can be used to trigger a...

CVE-2022-35990: Reachable Assertion

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

Google TensorFlow 安全漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that FakeQuantWithMinMaxVars will fail to assert if it is given a tensor of non-zero rank min or max. An attacker...

Dynamic quorum votes parameters for a proposal (Proposal A) are changed according to another proposal (Proposal B) that proposes to update dynamic quorum votes parameters when Proposal B is executed after Proposal A is created in the same block

Lines of code Vulnerability details Impact The following writeQuorumParamsCheckpoint function is used to record dynamic quorum votes parameters at a block of interest. function writeQuorumParamsCheckpointDynamicQuorumParams memory params internal uint32 blockNumber = safe32block.number, 'block...

WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.3 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Kim Jong Min aka Universe Patchstack Alliance in WordPress Enable SVG, WebP & ICO Upload plugin versions = 1.0.3. Solution No patched version available...

PT-2022-32391

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.15 Description The issue concerns a data-race condition around the sysctl tcp min snd mss setting in the TCP implementation. This condition may potentially lead to security vulnerabilities, although the...

PT-2022-32613

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.58 Description The issue concerns a data-race condition around the sysctl tcp min snd mss setting in the TCP implementation. The actual impact and potential for attack have not been fully determined...

PT-2022-32797

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.134 Description The issue concerns a data-race around sysctl tcp min snd mss in the tcp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-32941

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.208 Description The issue concerns a data-race around sysctl tcp min snd mss in the tcp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2025-8591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to insufficient bounds propagation in the Linux kernel's bpf Berkeley Packet Filter functionality. Specifically, it concerns the adjust scalar min max vals function,...

CVE-2021-33648

When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers...

Huawei MindSpore Community 缓冲区错误漏洞

Huawei MindSpore Community is an open source deep learning framework from Huawei, China. Huawei MindSpore Community suffers from an information disclosure vulnerability that stems from accessing a shape allocated from the heap buffer if the input shape size is 0 when performing inferred shape...