rpm package
suse/tensorflow2_2_6_0-gnu-hpc&distro=SUSE Package Hub 15 SP3
pkg:rpm/suse/tensorflow2_2_6_0-gnu-hpc&distro=SUSE%20Package%20Hub%2015%20SP3
Vulnerabilities (63)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-37688 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://github.com/tensorflow/ | |
| CVE-2021-37686 | Med | 5.5 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definiti | |
| CVE-2021-37681 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is [vulnerable to a null pointer error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/ | |
| CVE-2021-37680 | Med | 5.5 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/te | |
| CVE-2021-37676 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.SparseFillEmptyRows`. The shape inference [implementation](https://github.com/tensorflow/ten | |
| CVE-2021-37675 | Med | 5.5 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions most implementations of convolution operators in TensorFlow are affected by a division by 0 vulnerability where an attacker can trigger a denial of service via a crash. The shape inference | |
| CVE-2021-37671 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.Map*` and `tf.raw_ops.OrderedMap*` operations. The [implementation](https://github.com/tenso | |
| CVE-2021-37667 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.UnicodeEncode`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de | |
| CVE-2021-37666 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`. The [implementation](https://github.com/tensorflow/tensorflow/blob/4 | |
| CVE-2021-37652 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can result in a use after free error if an attacker supplies specially crafted arguments. The [implementation](https://github | |
| CVE-2021-37648 | Hig | 7.8 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions the code for `tf.raw_ops.SaveV2` does not properly validate the inputs and an attacker can trigger a null pointer dereference. The [implementation](https://github.com/tensorflow/tensorflow | |
| CVE-2021-37664 | Hig | 7.3 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `BoostedTreesSparseCalculateBestFeatureSplit`. The [implementation](htt | |
| CVE-2021-37662 | Hig | 7.1 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in `BoostedTreesCalculateBestGainsPerFeature` and similar attack can occur in `BoostedTreesCalculateBestFeatu | |
| CVE-2021-37661 | Med | 5.5 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boosted_trees_create_quantile_stream_resource` by using negative arguments. The [implementation](https://github.com/tensorflow/tensorflow/blob | |
| CVE-2021-37659 | Hig | 7.3 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations) | |
| CVE-2021-37658 | Hig | 7.1 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixSetDiagV*`. The [implementation](https://github.com/tensorflow/ | |
| CVE-2021-37657 | Hig | 7.1 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixDiagV*`. The [implementation](https://github.com/tensorflow/ten | |
| CVE-2021-37656 | Hig | 7.1 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToSparse`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f2 | |
| CVE-2021-37655 | Hig | 7.3 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to `tf.raw_ops.ResourceScatterUpdate`. The [implementation](https://github.com/ten | |
| CVE-2021-37654 | Hig | 7.3 | < 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 | Aug 12, 2021 | TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API |
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://github.com/tensorflow/
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definiti
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is [vulnerable to a null pointer error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/te
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.SparseFillEmptyRows`. The shape inference [implementation](https://github.com/tensorflow/ten
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions most implementations of convolution operators in TensorFlow are affected by a division by 0 vulnerability where an attacker can trigger a denial of service via a crash. The shape inference
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.Map*` and `tf.raw_ops.OrderedMap*` operations. The [implementation](https://github.com/tenso
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.UnicodeEncode`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`. The [implementation](https://github.com/tensorflow/tensorflow/blob/4
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can result in a use after free error if an attacker supplies specially crafted arguments. The [implementation](https://github
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the code for `tf.raw_ops.SaveV2` does not properly validate the inputs and an attacker can trigger a null pointer dereference. The [implementation](https://github.com/tensorflow/tensorflow
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `BoostedTreesSparseCalculateBestFeatureSplit`. The [implementation](htt
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in `BoostedTreesCalculateBestGainsPerFeature` and similar attack can occur in `BoostedTreesCalculateBestFeatu
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boosted_trees_create_quantile_stream_resource` by using negative arguments. The [implementation](https://github.com/tensorflow/tensorflow/blob
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations)
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixSetDiagV*`. The [implementation](https://github.com/tensorflow/
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixDiagV*`. The [implementation](https://github.com/tensorflow/ten
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToSparse`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f2
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to `tf.raw_ops.ResourceScatterUpdate`. The [implementation](https://github.com/ten
- affected < 2.6.0-bp153.2.3.1fixed 2.6.0-bp153.2.3.1
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API
Page 2 of 4