PYSEC-2020-270

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

Design/Logic Flaw

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to dlpack.todlpack the expected validations will cause variables to bind to nullptr while setting a status variable to the error condition. However, this status argument is not properly checked. Hence, code...

PYSEC-2020-306

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to dlpack.todlpack the expected validations will cause variables to bind to nullptr while setting a status variable to the error condition. However, this status argument is not properly checked. Hence, code...

CVE-2020-15190

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the tf.rawops.Switch operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. Howeve...

Undefined behavior in Tensorflow

Impact If a user passes an invalid argument to dlpack.todlpack the expected validations will cause variables to bind to nullptr while setting a status variable to the error condition. However, this status argument is not properly checked:...

GHSA-Q8QJ-FC9Q-CPHR Undefined behavior in Tensorflow

Impact If a user passes an invalid argument to dlpack.todlpack the expected validations will cause variables to bind to nullptr while setting a status variable to the error condition. However, this status argument is not properly checked:...

PT-2020-14262 · Google +1 · Tensorflow +1

Name of the Vulnerable Software and Affected Versions: Tensorflow versions prior to 2.2.1 Tensorflow versions prior to 2.3.1 Description: The issue arises when a user passes an invalid argument to dlpack.to dlpack, causing variables to bind to nullptr while setting a status variable to the error...

FreeBSD : gnupg -- AEAD key import overflow (f9fa7adc-ee51-11ea-a240-002590acae31)

Importing an OpenPGP key having a preference list for AEAD algorithms will lead to an array overflow and thus often to a crash or other undefined behaviour. Importing an arbitrary key can often easily be triggered by an attacker and thus triggering this bug. Exploiting the bug aside from crashes ...

GHSA-FW4P-36J9-RRJ3 Denial of Service in sequelize

Versions of sequelize prior to 4.44.4 are vulnerable to Denial of Service DoS. The SQLite dialect fails to catch a TypeError exception for the results variable. The results value may be undefined and trigger the error on a .map call. This may allow attackers to submit malicious input that forces...

gnupg -- AEAD key import overflow

Importing an OpenPGP key having a preference list for AEAD algorithms will lead to an array overflow and thus often to a crash or other undefined behaviour. Importing an arbitrary key can often easily be triggered by an attacker and thus triggering this bug. Exploiting the bug aside from crashes ...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2020-1849)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RUSTSEC-2020-0035 Chunk API does not respect align requirement

Chunk API does not respect the align requirement of types. Unaligned reference can be created with the API, which is an undefined behavior...

Chunk API does not respect align requirement

Chunk API does not respect the align requirement of types. Unaligned reference can be created with the API, which is an undefined behavior...

usrsctp:fuzzer_connect: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6219321542705152 Project: usrsctp Fuzzing Engine: libFuzzer Fuzz Target: fuzzerconnect Job Type: libfuzzerubsanusrsctp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f06700b6bf0 Crash State: NULL Sanitizer: undefined UBSAN...

openSUSE Security Update : ldb / samba (openSUSE-2020-1023)

"This update for ldb, samba fixes the following issues : Changes in samba : - Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; bso14364 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

c-blosc2:decompress_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5084174348976128 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressfuzzer Job Type: libfuzzerubsanc-blosc2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000002d21 Crash State: NULL Sanitizer: undefined UBSAN...

ffmpeg:ffmpeg_AV_CODEC_ID_HCA_fuzzer: Index-out-of-bounds in reconstruct_hfr

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5089866596745216 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDHCAfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash...

pcapplusplus:FuzzTarget: Bad-cast to pcpp::IDnsResourcepcpp::DnsLayer::parseResources in pcpp::DnsLayer::DnsLayer

Detailed Report: https://oss-fuzz.com/testcase?key=5781142119907328 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000021c1c00 Crash State: Bad-cast to...

opensc:fuzz_pkcs15_reader: Index-out-of-bounds in tcos_compute_signature

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5769298181357568 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15reader Job Type: libfuzzerubsanopensc Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

stb:stbi_read_fuzzer: Index-out-of-bounds in stbi__build_huffman

Detailed Report: https://oss-fuzz.com/testcase?key=4911634777899008 Project: stb Fuzzing Engine: libFuzzer Fuzz Target: stbireadfuzzer Job Type: libfuzzerubsanstb Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: stbibuildhuffman stbiprocessmarker stbidecodejpegheader...