PT-2022-26149 · Fastify · Fastify

Name of the Vulnerable Software and Affected Versions: Fastify versions prior to 3.29.4 Fastify versions prior to 4.10.2 Description: The issue allows an attacker to bypass the Pre-Flight checking of fetch by using an incorrect Content-Type. This could potentially be used to invoke routes that on...

CVE-2022-41887

TensorFlow is an open source platform for machine learning. tf.keras.losses.poisson receives a ypred and ytrue that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched...

CVE-2022-41887

TensorFlow CVE-2022-41887 describes a buffer/size-mismatch overflow in tf.keras.losses.poisson when y_pred/y_true dimensions overflow an int32 during broadcasting in BinaryOp. A patch is committed (c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c) and will be included in TensorFlow 2.11; TensorFlow 2.10....

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google TensorFlow is vulnerable to a buffer overflow vulnerability that originates when an operation with a specified input size receives a different number of inputs, and the executor will crash. No...

PT-2022-26125

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1 and earlier TensorFlow versions 2.9.3 and earlier TensorFlow versions 2.8.4 and earlier Description The reference kernel of the CONV 3D TRANSPOSE TensorFlow Lite operator wrongly...

CVE-2022-41887 Overflow in `tf.keras.losses.poisson` in Tensorflow

TensorFlow is an open source platform for machine learning. tf.keras.losses.poisson receives a ypred and ytrue that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched...

PT-2022-26118

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1 and earlier TensorFlow versions 2.9.3 and earlier Description TensorFlow is an open source platform for machine learning. The tf.keras.losses.poisson function receives a y pred and y...

CVE-2022-41887

TensorFlow is an open source platform for machine learning. tf.keras.losses.poisson receives a ypred and ytrue that are passed through functor::mul in BinaryOp. If the resulting dimensions overflow an int32, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched...

kernel: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t

A vulnerability was found in the Linux kernel's CS35L41 driver. The constant CS35L41NUMOTPELEM is defined as 100 but is used by the arrays otpmap1 and otpmap2, which are both expected to contain only 99 elements. This mismatch causes the code to access memory past the array boundaries when...

kernel: dm raid: fix address sanitizer warning in raid_resume

In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raidresume There is a KASAN warning in raidresume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev-raiddisks is greater than rs-raiddisks, so the loop...

NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2022-0083)

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities: - Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. CVE-2020-8231 - A malicious server can use the FTP...

GSD-2022-1007054 crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr

crypto: hisilicon/zip - fix mismatch in get/set sglsgenr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...

PT-2022-35512 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to a mismatch in get/set sgl sge nr in the hisilicon/zip crypto module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

OESA-2022-2051 dbus security update

Security Fixes: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.CVE-2022-42010 An...

CVE-2022-44559

The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation...

CVE-2022-44562

The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation...

CVE-2022-44558

The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation...

CVE-2022-44558

The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation...

PT-2022-27243 · Unknown · Ams Module

Name of the Vulnerable Software and Affected Versions: AMS module affected versions not specified Description: The issue is related to a serialization/deserialization mismatch in the AMS module. This could potentially lead to privilege escalation if successfully exploited. Recommendations: At the...

PT-2022-27244 · Unknown · Ams Module

Name of the Vulnerable Software and Affected Versions: AMS module affected versions not specified Description: The issue is related to a serialization/deserialization mismatch in the AMS module. This could potentially lead to privilege escalation if successfully exploited. Recommendations: At the...