tensorflow-cpu

Vulnerabilities (417)

• CVE-2021-37685MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions TFLite's [`expand_dims.cc`](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/expand_dims.cc#L36-L50) contains a vulnerability

• CVE-2021-37684MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit [dfa22b348b70bb8

• CVE-2021-37683MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is [vulnerable to a division by 0 error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/ker

• CVE-2021-37682MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tens

• CVE-2021-37679HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output

• CVE-2021-37678CriAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The [implementation](https://github.com/tensorflow/tensorflow/blo

• CVE-2021-37677MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the shape inference code for `tf.raw_ops.Dequantize` has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments. The shape inferenc

• CVE-2021-37674MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a segmentation fault in `tf.raw_ops.MaxPoolGrad` caused by missing validation. The [implementation](https://github.com/tensorflow/tensorflow

• CVE-2021-37673MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.MapStage`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1

• CVE-2021-37672MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.SdcaOptimizerV2`. The [implementation](https://github.com/t

• CVE-2021-37670MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.UpperBound`. The [implementation](https://github.com/tensor

• CVE-2021-37669MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving models using `tf.raw_ops.NonMaxSuppressionV5` by triggering a division by 0. The [implementation](https://github.com/tensorf

• CVE-2021-37668MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause denial of service in applications serving models using `tf.raw_ops.UnravelIndex` by triggering a division by 0. The [implementation](https://github.com/tensorflow/ten

• CVE-2021-37665HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bo

• CVE-2021-37663HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in `tf.raw_ops.QuantizeV2`, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap

• CVE-2021-37689HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. This is caused by the MLIR optimization of `L2Norma

• CVE-2021-37688HigAug 12, 2021
  affected >= 2.5.0, < 2.5.1fixed 2.5.1

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://github.com/tensorflow/

• CVE-2021-37686MedAug 12, 2021
  affected >= 2.6.0rc0, < 2.6.0rc2fixed 2.6.0rc2

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definiti

• CVE-2021-37681HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is [vulnerable to a null pointer error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/

• CVE-2021-37680MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/te