Low severityNVD Advisory· Published Dec 16, 2019· Updated Aug 5, 2024
Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow
CVE-2019-16778
Description
In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | < 1.15.0 | 1.15.0 |
tensorflow-cpuPyPI | < 1.15.0 | 1.15.0 |
tensorflow-gpuPyPI | < 1.15.0 | 1.15.0 |
Affected products
4- ghsa-coords3 versions
< 1.15.0+ 2 more
- (no CPE)range: < 1.15.0
- (no CPE)range: < 1.15.0
- (no CPE)range: < 1.15.0
- Range: < 1.15
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-844w-j86r-4x2jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-16778ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-227.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-234.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-209.yamlghsaWEB
- github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2019-002.mdghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/commit/db4f9717c41bccc3ce10099ab61996b246099892ghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-844w-j86r-4x2jghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.