PyPI package
tensorflow-cpu
pkg:pypi/tensorflow-cpu
Vulnerabilities (417)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-23591 | — | < 2.5.3 | 2.5.3 | Feb 4, 2022 | Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loadi | ||
| CVE-2022-23593 | — | >= 2.8.0-rc0, < 2.8.0 | 2.8.0 | Feb 4, 2022 | Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build | ||
| CVE-2022-21740 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3 | ||
| CVE-2022-21741 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a divi | ||
| CVE-2022-21737 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy. | ||
| CVE-2022-21738 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also c | ||
| CVE-2022-21739 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `QuantizedMaxPool` has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this com | ||
| CVE-2022-21734 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `MapStage` is vulnerable a `CHECK`-fail if the key tensor is not a scalar. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and T | ||
| CVE-2022-21735 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalMaxPool` can be made to crash a TensorFlow process via a division by 0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6. | ||
| CVE-2022-23569 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). This is similar to TFSA-2021-198 and has similar fixes. We have patched the reported issues in multi | ||
| CVE-2022-21729 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by an integer overflow bug. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2 | ||
| CVE-2022-21725 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a division by 0. The function fails to check that the stride argument is strictly positive. Hence, the fix is to add a check for the stride ar | ||
| CVE-2022-21736 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseTensorSliceDataset` has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value. The 3 input arguments to `SparseTensorSliceDataset` represent a sparse ten | ||
| CVE-2022-23567 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so, | ||
| CVE-2022-23568 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `AddManySparseToTensorsMap` is vulnerable to an integer overflow which results in a `CHECK`-fail when building new `TensorShape` objects (so, an assert failure based denial of service). We are missing | ||
| CVE-2022-21731 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack via a segfault caused by a type confusion. The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper | ||
| CVE-2022-21733 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing | ||
| CVE-2022-21732 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocating too much memory. This is because the `num_threads` argument is only checked to not be negative, but there is no upper | ||
| CVE-2022-21727 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer overflow weakness. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the num | ||
| CVE-2022-21726 | — | < 2.5.3 | 2.5.3 | Feb 3, 2022 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and can result in heap OOB accesses. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value a |
- CVE-2022-23591Feb 4, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loadi
- CVE-2022-23593Feb 4, 2022affected >= 2.8.0-rc0, < 2.8.0fixed 2.8.0
Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build
- CVE-2022-21740Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3
- CVE-2022-21741Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a divi
- CVE-2022-21737Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy.
- CVE-2022-21738Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also c
- CVE-2022-21739Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `QuantizedMaxPool` has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this com
- CVE-2022-21734Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `MapStage` is vulnerable a `CHECK`-fail if the key tensor is not a scalar. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and T
- CVE-2022-21735Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalMaxPool` can be made to crash a TensorFlow process via a division by 0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.
- CVE-2022-23569Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). This is similar to TFSA-2021-198 and has similar fixes. We have patched the reported issues in multi
- CVE-2022-21729Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by an integer overflow bug. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2
- CVE-2022-21725Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a division by 0. The function fails to check that the stride argument is strictly positive. Hence, the fix is to add a check for the stride ar
- CVE-2022-21736Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseTensorSliceDataset` has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value. The 3 input arguments to `SparseTensorSliceDataset` represent a sparse ten
- CVE-2022-23567Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so,
- CVE-2022-23568Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `AddManySparseToTensorsMap` is vulnerable to an integer overflow which results in a `CHECK`-fail when building new `TensorShape` objects (so, an assert failure based denial of service). We are missing
- CVE-2022-21731Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack via a segfault caused by a type confusion. The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper
- CVE-2022-21733Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing
- CVE-2022-21732Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocating too much memory. This is because the `num_threads` argument is only checked to not be negative, but there is no upper
- CVE-2022-21727Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer overflow weakness. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the num
- CVE-2022-21726Feb 3, 2022affected < 2.5.3fixed 2.5.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and can result in heap OOB accesses. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value a
Page 9 of 21