Search for packages
| purl | pkg:pypi/tensorflow@2.2.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-15bp-snhe-1ygs
Aliases: CVE-2021-29570 GHSA-545v-42p7-98fq PYSEC-2021-207 PYSEC-2021-498 PYSEC-2021-696 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-1736-xm66-2qfb
Aliases: CVE-2021-29591 GHSA-cwv3-863g-39vx PYSEC-2021-228 PYSEC-2021-519 PYSEC-2021-717 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-1dus-skme-ykbv
Aliases: CVE-2021-29612 GHSA-2xgj-xhgf-ggjv PYSEC-2021-249 PYSEC-2021-540 PYSEC-2021-738 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-1eqg-uh5g-6kck
Aliases: CVE-2021-29532 GHSA-j47f-4232-hvv8 PYSEC-2021-169 PYSEC-2021-460 PYSEC-2021-658 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-1sr1-happ-6ugc
Aliases: CVE-2021-41221 GHSA-cqv6-3phm-hcwx PYSEC-2021-413 PYSEC-2021-630 PYSEC-2021-828 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-22fu-tcf3-jqfa
Aliases: CVE-2021-29536 GHSA-2gfx-95x2-5v3x PYSEC-2021-173 PYSEC-2021-464 PYSEC-2021-662 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-2cw7-2xzs-abfz
Aliases: CVE-2021-41217 GHSA-5crj-c72x-m7gq PYSEC-2021-409 PYSEC-2021-626 PYSEC-2021-824 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-2hqc-3d51-4yf5
Aliases: CVE-2021-41198 GHSA-2p25-55c9-h58q PYSEC-2021-391 PYSEC-2021-608 PYSEC-2021-806 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-2m1n-m5m2-mqb5
Aliases: CVE-2021-29590 GHSA-24x6-8c7m-hv3f PYSEC-2021-227 PYSEC-2021-518 PYSEC-2021-716 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-2qkj-a4mh-z3c7
Aliases: CVE-2021-29582 GHSA-c45w-2wxr-pp53 PYSEC-2021-219 PYSEC-2021-510 PYSEC-2021-708 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-3dm7-19pb-2kb1
Aliases: CVE-2021-29586 GHSA-26j7-6w8w-7922 PYSEC-2021-223 PYSEC-2021-514 PYSEC-2021-712 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-3ek8-jc2a-bfcq
Aliases: CVE-2021-29618 GHSA-xqfj-cr6q-pc8w PYSEC-2021-255 PYSEC-2021-546 PYSEC-2021-744 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-3ndg-adf4-4kgw
Aliases: CVE-2021-29547 GHSA-4fg4-p75j-w5xj PYSEC-2021-184 PYSEC-2021-475 PYSEC-2021-673 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-3zv2-pyba-5bej
Aliases: CVE-2021-29588 GHSA-vfr4-x8j2-3rf9 PYSEC-2021-225 PYSEC-2021-516 PYSEC-2021-714 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-4htf-7y2p-uyc3
Aliases: CVE-2021-29549 GHSA-x83m-p7pv-ch8v PYSEC-2021-186 PYSEC-2021-477 PYSEC-2021-675 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-4z5r-weyj-abe7
Aliases: CVE-2021-29616 GHSA-4hvv-7x94-7vq8 PYSEC-2021-253 PYSEC-2021-544 PYSEC-2021-742 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-5d73-819a-xbeg
Aliases: CVE-2021-41209 GHSA-6hpv-v2rx-c5g6 PYSEC-2021-401 PYSEC-2021-618 PYSEC-2021-816 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-5hqy-s6hh-cfb6
Aliases: CVE-2021-29577 GHSA-v6r6-84gr-92rm PYSEC-2021-214 PYSEC-2021-505 PYSEC-2021-703 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-5nh2-gkqw-hbgp
Aliases: CVE-2021-29607 GHSA-gv26-jpj9-c8gq PYSEC-2021-244 PYSEC-2021-535 PYSEC-2021-733 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-5nsx-yqxh-77cb
Aliases: CVE-2021-29552 GHSA-jhq9-wm9m-cf89 PYSEC-2021-189 PYSEC-2021-480 PYSEC-2021-678 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-5r7h-k5vv-5qda
Aliases: CVE-2021-29611 GHSA-9rpc-5v9q-5r7f PYSEC-2021-248 PYSEC-2021-539 PYSEC-2021-737 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-5ty2-z944-mbht
Aliases: CVE-2021-41214 GHSA-vwhq-49r4-gj9v PYSEC-2021-406 PYSEC-2021-623 PYSEC-2021-821 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-5u92-aa9z-87c7
Aliases: CVE-2021-29598 GHSA-pmpr-55fj-r229 PYSEC-2021-235 PYSEC-2021-526 PYSEC-2021-724 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-5vx7-bwx7-wfbw
Aliases: CVE-2021-29576 GHSA-7cqx-92hp-x6wh PYSEC-2021-213 PYSEC-2021-504 PYSEC-2021-702 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-5w93-rzzm-vkb9
Aliases: CVE-2021-29527 GHSA-x4g7-fvjj-prg8 PYSEC-2021-164 PYSEC-2021-455 PYSEC-2021-653 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-5xgg-h9wh-3uh7
Aliases: CVE-2021-41226 GHSA-374m-jm66-3vj8 PYSEC-2021-418 PYSEC-2021-635 PYSEC-2021-833 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-63n6-7fva-5qh7
Aliases: CVE-2020-15197 GHSA-qc53-44cj-vfvx PYSEC-2020-120 PYSEC-2020-277 PYSEC-2020-312 |
In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a `CHECK` assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1. |
Affected by 205 other vulnerabilities. |
|
VCID-688g-g33x-67g9
Aliases: CVE-2021-41223 GHSA-f54p-f6jp-4rhr PYSEC-2021-415 PYSEC-2021-632 PYSEC-2021-830 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-6pgh-52f1-rbde
Aliases: CVE-2021-29548 GHSA-p45v-v4pw-77jr PYSEC-2021-185 PYSEC-2021-476 PYSEC-2021-674 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-6tpr-dnht-t3eb
Aliases: CVE-2021-29551 GHSA-vqw6-72r7-fgw7 PYSEC-2021-188 PYSEC-2021-479 PYSEC-2021-677 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-7hck-1dxy-buf4
Aliases: CVE-2021-29572 GHSA-5gqf-456p-4836 PYSEC-2021-209 PYSEC-2021-500 PYSEC-2021-698 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-7j19-q4yr-mbcs
Aliases: CVE-2020-26266 GHSA-qhxx-j73r-qpm2 PYSEC-2020-254 PYSEC-2020-297 PYSEC-2020-332 |
multiple issues |
Affected by 146 other vulnerabilities. Affected by 200 other vulnerabilities. |
|
VCID-7tq1-zhms-yybt
Aliases: CVE-2020-15196 GHSA-pg59-2f92-5cph PYSEC-2020-119 PYSEC-2020-276 PYSEC-2020-311 |
In Tensorflow version 2.3.0, the `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same shape as the data. The check exists for `DenseCountSparseOutput`, where both tensors are fully specified. In the sparse and ragged count weights are still accessed in parallel with the data. But, since there is no validation, a user passing fewer weights than the values for the tensors can generate a read from outside the bounds of the heap buffer allocated for the weights. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1. |
Affected by 205 other vulnerabilities. |
|
VCID-81vb-55gk-guhy
Aliases: CVE-2021-29600 GHSA-j8qh-3xrq-c825 PYSEC-2021-237 PYSEC-2021-528 PYSEC-2021-726 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-84kt-r79z-bkfu
Aliases: CVE-2021-29530 GHSA-xcwj-wfcm-m23c PYSEC-2021-167 PYSEC-2021-458 PYSEC-2021-656 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-85qc-3pn5-1fas
Aliases: CVE-2021-29595 GHSA-vf94-36g5-69v8 PYSEC-2021-232 PYSEC-2021-523 PYSEC-2021-721 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-893t-26y6-kff7
Aliases: CVE-2021-29581 GHSA-vq2r-5xvm-3hc3 PYSEC-2021-218 PYSEC-2021-509 PYSEC-2021-707 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-8cew-f7ja-5bbe
Aliases: CVE-2020-15265 GHSA-rrfp-j2mp-hq9c PYSEC-2020-138 PYSEC-2020-295 PYSEC-2020-330 |
denial of service |
Affected by 198 other vulnerabilities. |
|
VCID-8ndu-z4z1-guds
Aliases: CVE-2021-29546 GHSA-m34j-p8rj-wjxq PYSEC-2021-183 PYSEC-2021-474 PYSEC-2021-672 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-8qg6-zuvb-6bb6
Aliases: CVE-2021-29596 GHSA-4vrf-ff7v-hpgr PYSEC-2021-233 PYSEC-2021-524 PYSEC-2021-722 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-8ujy-p25s-gqdr
Aliases: CVE-2020-26268 GHSA-hhvc-g5hv-48c6 PYSEC-2020-255 PYSEC-2020-299 PYSEC-2020-334 |
multiple issues |
Affected by 146 other vulnerabilities. Affected by 200 other vulnerabilities. |
|
VCID-96uv-19z4-2qgk
Aliases: CVE-2021-29606 GHSA-h4pc-gx2w-f2xv PYSEC-2021-243 PYSEC-2021-534 PYSEC-2021-732 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-984t-vw4n-wqf5
Aliases: CVE-2021-29568 GHSA-4p4p-www8-8fv9 PYSEC-2021-205 PYSEC-2021-496 PYSEC-2021-694 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-9a7a-hvpn-gke5
Aliases: CVE-2021-29597 GHSA-v52p-hfjf-wg88 PYSEC-2021-234 PYSEC-2021-525 PYSEC-2021-723 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-9dhc-1f13-5qht
Aliases: CVE-2021-41219 GHSA-4f99-p9c2-3j8x PYSEC-2021-411 PYSEC-2021-628 PYSEC-2021-826 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-9gde-ga9q-pqb4
Aliases: CVE-2021-41207 GHSA-7v94-64hj-m82h PYSEC-2021-399 PYSEC-2021-616 PYSEC-2021-814 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-9kx1-12yg-suc9
Aliases: CVE-2021-29520 GHSA-wcv5-qrj6-9pfm PYSEC-2021-157 PYSEC-2021-448 PYSEC-2021-646 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-9snf-qxka-83hd
Aliases: CVE-2021-41204 GHSA-786j-5qwq-r36x PYSEC-2021-397 PYSEC-2021-614 PYSEC-2021-812 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-9sxd-matk-23cp
Aliases: CVE-2021-29574 GHSA-828x-qc2p-wprq PYSEC-2021-211 PYSEC-2021-502 PYSEC-2021-700 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-9vmj-dga9-vbah
Aliases: CVE-2021-29540 GHSA-xgc3-m89p-vr3x PYSEC-2021-177 PYSEC-2021-468 PYSEC-2021-666 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-aad5-dg9x-53cz
Aliases: CVE-2021-41199 GHSA-5hx2-qx8j-qjqm PYSEC-2021-392 PYSEC-2021-609 PYSEC-2021-807 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-ad6g-q6my-5bdy
Aliases: CVE-2021-29593 GHSA-cfx7-2xpc-8w4h PYSEC-2021-230 PYSEC-2021-521 PYSEC-2021-719 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-adxp-jw64-akbz
Aliases: CVE-2021-29605 GHSA-jf7h-7m85-w2v2 PYSEC-2021-242 PYSEC-2021-533 PYSEC-2021-731 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-afzh-7fmb-17he
Aliases: CVE-2021-29518 GHSA-62gx-355r-9fhg PYSEC-2021-155 PYSEC-2021-446 PYSEC-2021-644 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-ahyr-2qmm-tqbb
Aliases: CVE-2021-29587 GHSA-j7rm-8ww4-xx2g PYSEC-2021-224 PYSEC-2021-515 PYSEC-2021-713 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-avbn-pm4q-nuer
Aliases: CVE-2021-29559 GHSA-59q2-x2qc-4c97 PYSEC-2021-196 PYSEC-2021-487 PYSEC-2021-685 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-b8fg-9cu3-5khz
Aliases: CVE-2021-29610 GHSA-mq5c-prh3-3f3h PYSEC-2021-247 PYSEC-2021-538 PYSEC-2021-736 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-b8sr-erwh-5yh8
Aliases: CVE-2021-41228 GHSA-3rcw-9p9x-582v PYSEC-2021-420 PYSEC-2021-637 PYSEC-2021-835 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-b9z6-zju3-s7bd
Aliases: CVE-2021-29613 GHSA-vvg4-vgrv-xfr7 PYSEC-2021-250 PYSEC-2021-541 PYSEC-2021-739 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-bdaz-61wa-ybe3
Aliases: CVE-2021-29578 GHSA-6f89-8j54-29xf PYSEC-2021-215 PYSEC-2021-506 PYSEC-2021-704 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-bkk1-p7vx-vkdh
Aliases: CVE-2021-29585 GHSA-mv78-g7wq-mhp4 PYSEC-2021-222 PYSEC-2021-513 PYSEC-2021-711 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-bm3u-2ych-eqac
Aliases: CVE-2021-41227 GHSA-j8c8-67vp-6mx7 PYSEC-2021-419 PYSEC-2021-636 PYSEC-2021-834 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-bw75-tr4m-vygp
Aliases: CVE-2021-29543 GHSA-fphq-gw9m-ghrv PYSEC-2021-180 PYSEC-2021-471 PYSEC-2021-669 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-c2rb-aeku-dfdu
Aliases: CVE-2021-29558 GHSA-mqh2-9wrp-vx84 PYSEC-2021-195 PYSEC-2021-486 PYSEC-2021-684 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-cak9-vt8q-dbhk
Aliases: CVE-2021-29567 GHSA-wp3c-xw9g-gpcg PYSEC-2021-204 PYSEC-2021-495 PYSEC-2021-693 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-cgnk-q2ak-rfhg
Aliases: CVE-2020-15199 GHSA-x5cp-9pcf-pp3h PYSEC-2020-122 PYSEC-2020-279 PYSEC-2020-314 |
In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the `splits` tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure. Since `BatchedMap` is equivalent to a vector, it needs to have at least one element to not be `nullptr`. If user passes a `splits` tensor that is empty or has exactly one element, we get a `SIGABRT` signal raised by the operating system. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1. |
Affected by 205 other vulnerabilities. |
|
VCID-cu5c-pmqv-xkdz
Aliases: CVE-2021-41200 GHSA-gh8h-7j2j-qv4f PYSEC-2021-393 PYSEC-2021-610 PYSEC-2021-808 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-cyjm-89wt-hbdy
Aliases: CVE-2021-29519 GHSA-772j-h9xw-ffp5 PYSEC-2021-156 PYSEC-2021-447 PYSEC-2021-645 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-d7j8-4k9m-9kb5
Aliases: CVE-2021-29545 GHSA-hmg3-c7xj-6qwm PYSEC-2021-182 PYSEC-2021-473 PYSEC-2021-671 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-dbb5-21xw-fbfh
Aliases: CVE-2021-29580 GHSA-x8h6-xgqx-jqgp PYSEC-2021-217 PYSEC-2021-508 PYSEC-2021-706 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-dumr-5w15-kbfg
Aliases: CVE-2020-15198 GHSA-jc87-6vpp-7ff3 PYSEC-2020-121 PYSEC-2020-278 PYSEC-2020-313 |
In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has the same shape as the `values` one. The values in these tensors are always accessed in parallel. Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1. |
Affected by 205 other vulnerabilities. |
|
VCID-ee2j-htng-z7d3
Aliases: CVE-2021-29538 GHSA-j8qc-5fqr-52fp PYSEC-2021-175 PYSEC-2021-466 PYSEC-2021-664 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-ekez-y9nd-bbgz
Aliases: CVE-2021-29563 GHSA-ph87-fvjr-v33w PYSEC-2021-200 PYSEC-2021-491 PYSEC-2021-689 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-exm3-hpp6-g7hg
Aliases: CVE-2021-41205 GHSA-49rx-x2rw-pc6f PYSEC-2021-398 PYSEC-2021-615 PYSEC-2021-813 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-f8xv-gky2-kuhu
Aliases: CVE-2021-29537 GHSA-8c89-2vwr-chcq PYSEC-2021-174 PYSEC-2021-465 PYSEC-2021-663 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-f9ua-tntc-7fb1
Aliases: CVE-2021-29515 GHSA-hc6c-75p4-hmq4 PYSEC-2021-152 PYSEC-2021-443 PYSEC-2021-641 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-fasn-dhy8-yub8
Aliases: CVE-2021-29556 GHSA-fxqh-cfjm-fp93 PYSEC-2021-193 PYSEC-2021-484 PYSEC-2021-682 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-fe5k-3n3u-j3cg
Aliases: CVE-2021-29571 GHSA-whr9-vfh2-7hm6 PYSEC-2021-208 PYSEC-2021-499 PYSEC-2021-697 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-fm3p-x44b-s7fc
Aliases: CVE-2021-29575 GHSA-6qgm-fv6v-rfpv PYSEC-2021-212 PYSEC-2021-503 PYSEC-2021-701 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-fx76-8ajz-qkd3
Aliases: CVE-2021-29535 GHSA-m3f9-w3p3-p669 PYSEC-2021-172 PYSEC-2021-463 PYSEC-2021-661 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-g144-4yvx-xybr
Aliases: CVE-2021-41202 GHSA-xrqm-fpgr-6hhx PYSEC-2021-395 PYSEC-2021-612 PYSEC-2021-810 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-g423-bnfj-kybz
Aliases: CVE-2021-41224 GHSA-rg3m-hqc5-344v PYSEC-2021-416 PYSEC-2021-633 PYSEC-2021-831 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-gbft-tx74-wkhf
Aliases: CVE-2021-41210 GHSA-m342-ff57-4jcc PYSEC-2021-402 PYSEC-2021-619 PYSEC-2021-817 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-gbx8-z6n4-7ydc
Aliases: CVE-2021-29557 GHSA-xw93-v57j-fcgh PYSEC-2021-194 PYSEC-2021-485 PYSEC-2021-683 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-hqx5-weu3-t7cb
Aliases: CVE-2021-29517 GHSA-772p-x54p-hjrv PYSEC-2021-154 PYSEC-2021-445 PYSEC-2021-643 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-htd7-d3jj-3ubs
Aliases: CVE-2021-29565 GHSA-r6pg-pjwc-j585 PYSEC-2021-202 PYSEC-2021-493 PYSEC-2021-691 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-htjj-5ms9-akfz
Aliases: CVE-2021-29544 GHSA-6g85-3hm8-83f9 PYSEC-2021-181 PYSEC-2021-472 PYSEC-2021-670 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-j8rk-k34q-hfgy
Aliases: CVE-2021-29554 GHSA-qg48-85hg-mqc5 PYSEC-2021-191 PYSEC-2021-482 PYSEC-2021-680 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-jbqp-8s14-nqf6
Aliases: CVE-2021-29514 GHSA-8h46-5m9h-7553 PYSEC-2021-151 PYSEC-2021-442 PYSEC-2021-640 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-k13c-kgag-dfgc
Aliases: CVE-2021-29569 GHSA-3h8m-483j-7xxm PYSEC-2021-206 PYSEC-2021-497 PYSEC-2021-695 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-k768-6ush-puhk
Aliases: CVE-2021-29584 GHSA-xvjm-fvxx-q3hv PYSEC-2021-221 PYSEC-2021-512 PYSEC-2021-710 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-ka3v-q689-n7a4
Aliases: CVE-2021-29529 GHSA-jfp7-4j67-8r3q PYSEC-2021-166 PYSEC-2021-457 PYSEC-2021-655 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-kujr-wk4f-aua3
Aliases: CVE-2021-29522 GHSA-c968-pq7h-7fxv PYSEC-2021-159 PYSEC-2021-450 PYSEC-2021-648 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-kumd-zcgr-ekb1
Aliases: CVE-2021-29579 GHSA-79fv-9865-4qcv PYSEC-2021-216 PYSEC-2021-507 PYSEC-2021-705 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-kupu-frrt-pqen
Aliases: CVE-2021-41216 GHSA-3ff2-r28g-w7h9 PYSEC-2021-408 PYSEC-2021-625 PYSEC-2021-823 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-m3vv-6tqs-sydv
Aliases: CVE-2021-29553 GHSA-h9px-9vqg-222h PYSEC-2021-190 PYSEC-2021-481 PYSEC-2021-679 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-m7af-p4up-33bh
Aliases: CVE-2021-29602 GHSA-rf3h-xgv5-2q39 PYSEC-2021-239 PYSEC-2021-530 PYSEC-2021-728 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-mq77-h12e-2ybx
Aliases: CVE-2020-15200 GHSA-x7rp-74x2-mjf3 PYSEC-2020-123 PYSEC-2020-280 PYSEC-2020-315 |
In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the `splits` tensor generate a valid partitioning of the `values` tensor. Thus, the code sets up conditions to cause a heap buffer overflow. A `BatchedMap` is equivalent to a vector where each element is a hashmap. However, if the first element of `splits_values` is not 0, `batch_idx` will never be 1, hence there will be no hashmap at index 0 in `per_batch_counts`. Trying to access that in the user code results in a segmentation fault. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1. |
Affected by 205 other vulnerabilities. |
|
VCID-mtxy-nkwy-pkcz
Aliases: CVE-2021-29583 GHSA-9xh4-23q4-v6wr PYSEC-2021-220 PYSEC-2021-511 PYSEC-2021-709 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-myjm-gbbc-qucg
Aliases: CVE-2021-41203 GHSA-7pxj-m4jf-r6h2 PYSEC-2021-396 PYSEC-2021-613 PYSEC-2021-811 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-n2wb-menj-87hu
Aliases: CVE-2021-29534 GHSA-6j9c-grc6-5m6g PYSEC-2021-171 PYSEC-2021-462 PYSEC-2021-660 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-nfr9-fgdn-4kh8
Aliases: CVE-2021-41222 GHSA-cpf4-wx82-gxp6 PYSEC-2021-414 PYSEC-2021-631 PYSEC-2021-829 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-njqw-ewga-nka4
Aliases: CVE-2021-29609 GHSA-cjc7-49v2-jp64 PYSEC-2021-246 PYSEC-2021-537 PYSEC-2021-735 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-nkbd-gkxc-43ba
Aliases: CVE-2021-29531 GHSA-3qxp-qjq7-w4hf PYSEC-2021-168 PYSEC-2021-459 PYSEC-2021-657 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-nxjj-u8zy-gbaz
Aliases: CVE-2021-29541 GHSA-xqfj-35wv-m3cr PYSEC-2021-178 PYSEC-2021-469 PYSEC-2021-667 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-p34z-fc5p-ryg1
Aliases: CVE-2021-29604 GHSA-8rm6-75mf-7r7r PYSEC-2021-241 PYSEC-2021-532 PYSEC-2021-730 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-pegb-mj64-fqgr
Aliases: CVE-2021-29516 GHSA-84mw-34w6-2q43 PYSEC-2021-153 PYSEC-2021-444 PYSEC-2021-642 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-psxc-9ka2-uuaj
Aliases: CVE-2020-15201 GHSA-p5f8-gfw5-33w4 PYSEC-2020-124 PYSEC-2020-281 PYSEC-2020-316 |
In Tensorflow before version 2.3.1, the `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the `splits` tensor generate a valid partitioning of the `values` tensor. Hence, the code is prone to heap buffer overflow. If `split_values` does not end with a value at least `num_values` then the `while` loop condition will trigger a read outside of the bounds of `split_values` once `batch_idx` grows too large. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1. |
Affected by 205 other vulnerabilities. |
|
VCID-ptys-rse5-9yep
Aliases: CVE-2021-29555 GHSA-r35g-4525-29fq PYSEC-2021-192 PYSEC-2021-483 PYSEC-2021-681 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-pwmn-8jqu-83es
Aliases: CVE-2021-29550 GHSA-f78g-q7r4-9wcv PYSEC-2021-187 PYSEC-2021-478 PYSEC-2021-676 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-q3xx-8h4b-2kez
Aliases: CVE-2020-26271 GHSA-q263-fvxm-m5mw PYSEC-2020-257 PYSEC-2020-302 PYSEC-2020-337 |
multiple issues |
Affected by 146 other vulnerabilities. Affected by 200 other vulnerabilities. |
|
VCID-q5yr-cajq-1bcj
Aliases: CVE-2021-29589 GHSA-3w67-q784-6w7c PYSEC-2021-226 PYSEC-2021-517 PYSEC-2021-715 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-qd5d-rh84-h3bd
Aliases: CVE-2021-29523 GHSA-2cpx-427x-q2c6 PYSEC-2021-160 PYSEC-2021-451 PYSEC-2021-649 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-qdnt-cg25-5kdx
Aliases: CVE-2021-41197 GHSA-prcg-wp5q-rv7p PYSEC-2021-390 PYSEC-2021-607 PYSEC-2021-805 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-qvnc-gzf6-y3f3
Aliases: CVE-2021-41196 GHSA-m539-j985-hcr8 PYSEC-2021-389 PYSEC-2021-606 PYSEC-2021-804 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-r32y-zznb-pyga
Aliases: CVE-2021-29615 GHSA-qw5h-7f53-xrp6 PYSEC-2021-252 PYSEC-2021-543 PYSEC-2021-741 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-r9rr-mbk1-8bah
Aliases: CVE-2021-29599 GHSA-97wf-p777-86jq PYSEC-2021-236 PYSEC-2021-527 PYSEC-2021-725 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-rk26-e4eh-e7a4
Aliases: CVE-2021-29533 GHSA-393f-2jr3-cp69 PYSEC-2021-170 PYSEC-2021-461 PYSEC-2021-659 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-rkx2-5nyj-bbhu
Aliases: CVE-2021-41218 GHSA-9crf-c6qr-r273 PYSEC-2021-410 PYSEC-2021-627 PYSEC-2021-825 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-rp89-jyjd-cbc2
Aliases: CVE-2020-15266 GHSA-xwhf-g6j5-j5gc PYSEC-2020-139 PYSEC-2020-296 PYSEC-2020-331 |
denial of service |
Affected by 198 other vulnerabilities. |
|
VCID-rpdd-ny62-jkee
Aliases: CVE-2021-29619 GHSA-wvjw-p9f5-vq28 PYSEC-2021-256 PYSEC-2021-547 PYSEC-2021-745 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-rr2a-8jrx-6ue8
Aliases: CVE-2021-41213 GHSA-h67m-xg8f-fxcf PYSEC-2021-405 PYSEC-2021-622 PYSEC-2021-820 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-rujq-67w1-u3g7
Aliases: CVE-2021-41225 GHSA-7r94-xv9v-63jw PYSEC-2021-417 PYSEC-2021-634 PYSEC-2021-832 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-sb7m-pngm-5fbj
Aliases: CVE-2021-41215 GHSA-x3v8-c8qx-3j3r PYSEC-2021-407 PYSEC-2021-624 PYSEC-2021-822 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-sd2q-w7wz-vke2
Aliases: CVE-2021-29513 GHSA-452g-f7fp-9jf7 PYSEC-2021-150 PYSEC-2021-441 PYSEC-2021-639 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-sdvq-3mgg-8bad
Aliases: CVE-2021-29524 GHSA-r4pj-74mg-8868 PYSEC-2021-161 PYSEC-2021-452 PYSEC-2021-650 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-sf59-u7jt-4bd5
Aliases: CVE-2021-41206 GHSA-pgcq-h79j-2f69 PYSEC-2021-843 PYSEC-2021-845 PYSEC-2021-847 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-t1jw-efcm-kkgx
Aliases: CVE-2020-26267 GHSA-c9f3-9wfr-wgh7 PYSEC-2020-140 PYSEC-2020-298 PYSEC-2020-333 |
multiple issues |
Affected by 146 other vulnerabilities. Affected by 200 other vulnerabilities. |
|
VCID-tdn4-zmmf-skgv
Aliases: CVE-2021-29564 GHSA-75f6-78jr-4656 PYSEC-2021-201 PYSEC-2021-492 PYSEC-2021-690 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-u1r8-c86t-r3bj
Aliases: CVE-2021-29539 GHSA-g4h2-gqm3-c9wq PYSEC-2021-176 PYSEC-2021-467 PYSEC-2021-665 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-u2wr-m7dj-fkax
Aliases: CVE-2021-29601 GHSA-9c84-4hx6-xmm4 PYSEC-2021-238 PYSEC-2021-529 PYSEC-2021-727 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-uz51-m6ng-mygx
Aliases: CVE-2021-29566 GHSA-pvrc-hg3f-58r6 PYSEC-2021-203 PYSEC-2021-494 PYSEC-2021-692 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-v4py-xnk2-qbc9
Aliases: CVE-2021-29594 GHSA-3qgw-p4fm-x7gf PYSEC-2021-231 PYSEC-2021-522 PYSEC-2021-720 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-v92m-yfvz-2khe
Aliases: CVE-2021-29608 GHSA-rgvq-pcvf-hx75 PYSEC-2021-245 PYSEC-2021-536 PYSEC-2021-734 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-vy9b-gx6f-hqbf
Aliases: CVE-2021-29592 GHSA-jjr8-m8g8-p6wv PYSEC-2021-229 PYSEC-2021-520 PYSEC-2021-718 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-w1sh-pmw3-z7fb
Aliases: CVE-2021-29614 GHSA-8pmx-p244-g88h PYSEC-2021-251 PYSEC-2021-542 PYSEC-2021-740 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-w2ns-kqmv-xfan
Aliases: CVE-2021-41208 GHSA-57wx-m983-2f88 PYSEC-2021-400 PYSEC-2021-617 PYSEC-2021-815 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-w5yv-rqt2-mkcy
Aliases: CVE-2021-29525 GHSA-xm2v-8rrw-w9pm PYSEC-2021-162 PYSEC-2021-453 PYSEC-2021-651 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-xbt8-r95u-sqbu
Aliases: CVE-2021-41201 GHSA-j86v-p27c-73fm PYSEC-2021-394 PYSEC-2021-611 PYSEC-2021-809 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-y251-x618-kqb1
Aliases: CVE-2020-26270 GHSA-m648-33qf-v3gp PYSEC-2020-256 PYSEC-2020-301 PYSEC-2020-336 |
multiple issues |
Affected by 146 other vulnerabilities. Affected by 200 other vulnerabilities. |
|
VCID-y37k-6f6n-myd3
Aliases: CVE-2021-29573 GHSA-9vpm-rcf4-9wqw PYSEC-2021-210 PYSEC-2021-501 PYSEC-2021-699 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-y7hx-h69v-wfcy
Aliases: CVE-2021-41212 GHSA-fr77-rrx3-cp7g PYSEC-2021-404 PYSEC-2021-621 PYSEC-2021-819 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 79 other vulnerabilities. |
|
VCID-y87e-g3nh-hbgx
Aliases: CVE-2021-29560 GHSA-8gv3-57p6-g35r PYSEC-2021-197 PYSEC-2021-488 PYSEC-2021-686 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-y8f2-x15n-7ycg
Aliases: CVE-2021-29561 GHSA-gvm4-h8j3-rjrq PYSEC-2021-198 PYSEC-2021-489 PYSEC-2021-687 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-yh43-ndzp-4ue9
Aliases: CVE-2021-41195 GHSA-cq76-mxrc-vchh PYSEC-2021-842 PYSEC-2021-844 PYSEC-2021-846 |
multiple issues |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-yv86-j6kw-xbb7
Aliases: CVE-2021-29542 GHSA-4hrh-9vmp-2jgg PYSEC-2021-179 PYSEC-2021-470 PYSEC-2021-668 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-z89g-f2a7-9yhg
Aliases: CVE-2021-29603 GHSA-crch-j389-5f84 PYSEC-2021-240 PYSEC-2021-531 PYSEC-2021-729 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-z8mc-3qt1-2qhp
Aliases: CVE-2021-29617 GHSA-mmq6-q8r3-48fm PYSEC-2021-254 PYSEC-2021-545 PYSEC-2021-743 |
multiple issues |
Affected by 43 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-z9y3-drjc-mycn
Aliases: CVE-2021-29528 GHSA-6f84-42vf-ppwp PYSEC-2021-165 PYSEC-2021-456 PYSEC-2021-654 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-zg2k-9558-g7c3
Aliases: CVE-2021-29562 GHSA-36vm-xw34-x4pj PYSEC-2021-199 PYSEC-2021-490 PYSEC-2021-688 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
|
VCID-zh2k-2s8c-bqfn
Aliases: CVE-2021-29526 GHSA-4vf2-4xcg-65cx PYSEC-2021-163 PYSEC-2021-454 PYSEC-2021-652 |
multiple issues |
Affected by 76 other vulnerabilities. Affected by 129 other vulnerabilities. Affected by 127 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1ugt-z92x-nfbr | In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `output_data` buffer. This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits. The issue is patched in commit 204945b19e44b57906c9344c0d00120eeeae178a and is released in TensorFlow versions 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that the segment ids are all positive, although this only handles the case when the segment ids are stored statically in the model. A similar validation could be done if the segment ids are generated at runtime between inference steps. If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code. |
CVE-2020-15212
GHSA-hx2x-85gr-wrpq PYSEC-2020-135 PYSEC-2020-292 PYSEC-2020-327 |
| VCID-3r8v-c8cq-dkfp | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's `SavedModel` protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using `tensorflow-serving` or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15206
GHSA-w5gh-2wr2-pm6g PYSEC-2020-129 PYSEC-2020-286 PYSEC-2020-321 |
| VCID-43f5-tkpy-2udu | In eager mode, TensorFlow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference In linked snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately dereferences this, we get a segmentation fault. The issue is patched in commit 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15204
GHSA-q8gv-q7wr-9jf8 PYSEC-2020-127 PYSEC-2020-284 PYSEC-2020-319 |
| VCID-521d-c9br-zkfd | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, to mimic Python's indexing with negative values, TFLite uses `ResolveAxis` to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds. If the `DCHECK` does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption. The issue is patched in commit 2d88f470dea2671b430884260f3626b1fe99830a, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15207
GHSA-q4qf-3fc6-8x34 PYSEC-2020-130 PYSEC-2020-287 PYSEC-2020-322 |
| VCID-6hhj-dyd4-h3e1 | In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor. However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors. This results in special casing during validation at model loading time. Unfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays. This results in both read and write gadgets, albeit very limited in scope. The issue is patched in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83), and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that only operators which accept optional inputs use the `-1` special value and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-prone, we advise upgrading to the patched code. |
CVE-2020-15211
GHSA-cvpc-8phh-8f45 PYSEC-2020-134 PYSEC-2020-291 PYSEC-2020-326 |
| VCID-756y-beqv-wue6 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15209
GHSA-qh32-6jjc-qprm PYSEC-2020-132 PYSEC-2020-289 PYSEC-2020-324 |
| VCID-9xz7-2ysn-kfd3 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15208
GHSA-mxjj-953w-2c2v PYSEC-2020-131 PYSEC-2020-288 PYSEC-2020-323 |
| VCID-ac62-b5tn-13a9 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1." |
CVE-2020-15194
GHSA-9mqp-7v2h-2382 PYSEC-2020-117 PYSEC-2020-274 PYSEC-2020-309 |
| VCID-bfaj-n1c3-3kb2 | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure. The issue occurs because the `status` argument during validation failures is not properly checked. Since each of the above methods can return an error status, the `status` value must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1. |
CVE-2020-15192
GHSA-8fxw-76px-3rxv PYSEC-2020-115 PYSEC-2020-272 PYSEC-2020-307 |
| VCID-bpt2-9hm2-uqad | In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind to `nullptr` while setting a `status` variable to the error condition. However, this `status` argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1. |
CVE-2020-15191
GHSA-q8qj-fc9q-cphr PYSEC-2020-114 PYSEC-2020-271 PYSEC-2020-306 |
| VCID-d1s7-gp3x-1ff6 | In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor. However, there is nothing stopping users from passing in a Python object instead of a tensor. The uninitialized memory address is due to a `reinterpret_cast` Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1. |
CVE-2020-15193
GHSA-rjjg-hgv6-h69v PYSEC-2020-116 PYSEC-2020-273 PYSEC-2020-308 |
| VCID-eqxk-gvxj-eqa5 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15202
GHSA-h6fg-mjxg-hqq4 PYSEC-2020-125 PYSEC-2020-282 PYSEC-2020-317 |
| VCID-fsde-cbqa-37cd | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15190
GHSA-4g9f-63rx-5cw4 PYSEC-2020-113 PYSEC-2020-270 PYSEC-2020-305 |
| VCID-nnq7-5ej9-a7a9 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after `ee ff` are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15205
GHSA-g7p5-5759-qv46 PYSEC-2020-128 PYSEC-2020-285 PYSEC-2020-320 |
| VCID-pxu1-2kwn-fyh8 | In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15210
GHSA-x9j7-x98r-r4w2 PYSEC-2020-133 PYSEC-2020-290 PYSEC-2020-325 |
| VCID-qr42-9658-n3c6 | In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimensionality of output tensor. This results in allocating insufficient memory for the output tensor and in a write outside the bounds of the output array. This usually results in a segmentation fault, but depending on runtime conditions it can provide for a write gadget to be used in future memory corruption-based exploits. The issue is patched in commit 204945b19e44b57906c9344c0d00120eeeae178a and is released in TensorFlow versions 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that the segment ids are sorted, although this only handles the case when the segment ids are stored statically in the model. A similar validation could be done if the segment ids are generated at runtime between inference steps. If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code. |
CVE-2020-15214
GHSA-p2cq-cprg-frvm PYSEC-2020-137 PYSEC-2020-294 PYSEC-2020-329 |
| VCID-tnjr-7nd9-hqhe | In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor, attackers can use a very large value to trigger a large allocation. The issue is patched in commit 204945b19e44b57906c9344c0d00120eeeae178a and is released in TensorFlow versions 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to limit the maximum value in the segment ids tensor. This only handles the case when the segment ids are stored statically in the model, but a similar validation could be done if the segment ids are generated at runtime, between inference steps. However, if the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code. |
CVE-2020-15213
GHSA-hjmq-236j-8m87 PYSEC-2020-136 PYSEC-2020-293 PYSEC-2020-328 |
| VCID-ttt7-31wd-tbh1 | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15203
GHSA-xmq7-7fxm-rr79 PYSEC-2020-126 PYSEC-2020-283 PYSEC-2020-318 |
| VCID-zr9p-f8f6-5qez | In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern. It is possible for `reverse_index_map(i)` to be an index outside of bounds of `grad_values`, thus resulting in a heap buffer overflow. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. |
CVE-2020-15195
GHSA-63xm-rx5p-xvqr PYSEC-2020-118 PYSEC-2020-275 PYSEC-2020-310 |