CVE-2022-23560

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors. The fix is included in TensorFlow 2.8.0. We...

EUVD-2021-0350

Malware in sbrugna...

EUVD-2021-0262

Malware in sbrugna...

EUVD-2021-0344

Malware in sbrugna...

EUVD-2024-2351

Malicious code in bioql PyPI...

CVE-2021-37689

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. This is caused by the MLIR optimization of L2NormalizeReduceAxis...

CVE-2022-41909 Segfault in `CompositeTensorVariantToComponents` in Tensorflow

TensorFlow is an open source platform for machine learning. An input encoded that is not a valid CompositeTensorVariant tensor will trigger a segfault in tf.rawops.CompositeTensorVariantToComponents. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and...

PYSEC-2021-152

TensorFlow is an end-to-end open source platform for machine learning. The implementation of MatrixDiag operationshttps://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrixdiagop.ccL195-L197 does not validate that the tensor...

CVE-2021-29559

The CVE-2021-29559 case concerns TensorFlow’s UnicodeEncode in tf.raw_ops, where heap-out-of-bounds access can occur if input_value/input_splits do not form a valid sparse tensor. Root cause: implementation assumes a valid sparse tensor, enabling data access outside heap bounds. The issue is fixe...

Security Bulletin: WMLCE: libpcre in PCRE before 8.44 allows an integer overflow

Summary PCRE, which is using in TensorFlow allows an integer overflow via a large number after a ?C substring. Vulnerability Details CVEID: CVE-2020-14155 DESCRIPTION: PCRE could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in libpcre. By sending ...