tensorflow-cpu

Vulnerabilities (417)

• CVE-2021-37644MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions providing a negative element to `num_elements` list argument of `tf.raw_ops.TensorListReserve` causes the runtime to abort the process due to reallocating a `std::vector` to have a negativ

• CVE-2021-37641HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions if the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers. The [implementation](https://g

• CVE-2021-37635HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data. The [implementation](https://github.com/tensorflow/tensorflow

• CVE-2021-37649HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensor

• CVE-2021-37647HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops.SparseTensorSliceDataset` implementation can be made to dereference a null pointer. The [implementation](https://github.c

• CVE-2021-37643HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after

• CVE-2021-37639HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer. Alternatively, attackers can read memory outside the bounds of heap allocat

• CVE-2021-37638HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior. The [implementation](https://github.com/tensorflow/tens

• CVE-2021-37637HigAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to `tf.raw_ops.CompressElement`. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69

• CVE-2021-37660MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The [implementation](https://github.com/tensorfl

• CVE-2021-37653MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a floating point exception in `tf.raw_ops.ResourceGather`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181

• CVE-2021-37642MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e

• CVE-2021-37640MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf

• CVE-2021-37636MedAug 12, 2021
  affected < 2.3.4fixed 2.3.4

  TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825f

• CVE-2021-29619LowMay 14, 2021
  affected < 2.1.4fixed 2.1.4

  TensorFlow is an end-to-end open source platform for machine learning. Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSparseOutput` results in segfault. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on Tensor

• CVE-2021-29618LowMay 14, 2021
  affected < 2.1.4fixed 2.1.4

  TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on Tenso

• CVE-2021-29617LowMay 14, 2021
  affected < 2.1.4fixed 2.1.4

  TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2,

• CVE-2021-29616LowMay 14, 2021
  affected < 2.1.4fixed 2.1.4

  TensorFlow is an end-to-end open source platform for machine learning. The implementation of TrySimplify(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmetic_optimizer.cc#L390-L401) has undefined beh

• CVE-2021-29615LowMay 14, 2021
  affected < 2.1.4fixed 2.1.4

  TensorFlow is an end-to-end open source platform for machine learning. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack o

• CVE-2021-29614HigMay 14, 2021
  affected < 2.1.4fixed 2.1.4

  TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.io.decode_raw` produces incorrect results and crashes the Python interpreter when combining `fixed_length` and wider datatypes. The implementation of the padded version(https://github