p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in tensorflow · Seite 3

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für tensorflow: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 434

  1. CVE-2022-41890

    Mittel · CVSS 4.8EPSS 0,49%Korrektur verfügbar

    `CHECK` fail in `BCast` overflow in Tensorflow

    TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in `tf.experimental.numpy.outer` by passing in large input to the input `b`. We have patched the issue in GitHub commit 8310bf8dd188ff780e7fc53245058215a05bdbe5. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.10.1 aktualisieren
    • Auf 2.8.4 aktualisieren
    • Auf 2.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2022-41889

    Mittel · CVSS 5.5EPSS 0,45%Korrektur verfügbar

    Segfault via invalid attributes in `pywrap_tfe_src.cc` in Tensorflow

    TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a `nullptr`, which is not caught. An example can be seen in `tf.compat.v1.extract_volume_patches` by passing in quantized tensors as input `ksizes`. We have patched the issue in GitHub commit e9e95553e5411834d215e6770c81a83a3d0866ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.10.1 aktualisieren
    • Auf 2.8.4 aktualisieren
    • Auf 2.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2022-41888

    Mittel · CVSS 4.8EPSS 0,49%Korrektur verfügbar

    Unckecked rank size in `tf.image.generate_bounding_box_proposals` in Tensorflow

    TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must be of rank 4 but is not checked. We have patched the issue in GitHub commit cf35502463a88ca7185a99daa7031df60b3c1c98. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.10.1 aktualisieren
    • Auf 2.8.4 aktualisieren
    • Auf 2.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2022-41887

    Mittel · CVSS 4.8EPSS 0,49%Korrektur verfügbar

    Overflow in `tf.keras.losses.poisson` in Tensorflow

    TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched the issue in GitHub commit c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1 and 2.9.3, as these are also affected and still in supported range. However, we will not cherrypick this commit into TensorFlow 2.8.x, as it depends on Eigen behavior

    tensorflow tensorflow tensorflowPython
    • Auf 2.10.1 aktualisieren
    • Auf 2.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2022-41886

    Mittel · CVSS 4.8EPSS 0,48%Korrektur verfügbar

    Overflow in `ImageProjectiveTransformV2` in Tensorflow

    TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.10.1 aktualisieren
    • Auf 2.8.4 aktualisieren
    • Auf 2.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2022-41885

    Mittel · CVSS 4.8EPSS 0,47%Korrektur verfügbar

    Overflow in `FusedResizeAndPadConv2D` in Tensorflow

    TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.4 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2022-41884

    Mittel · CVSS 4.8EPSS 0,37%Korrektur verfügbar

    Seg fault in `ndarray_tensor_bridge` due to zero and large inputs in Tensorflow

    TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. We have patched the issue in GitHub commit 2b56169c16e375c521a3bc8ea658811cc0793784. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.10.1 aktualisieren
    • Auf 2.8.4 aktualisieren
    • Auf 2.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2022-41883

    Mittel · CVSS 6.8EPSS 0,38%Korrektur verfügbar

    Out of bounds segmentation fault due to unequal op inputs in Tensorflow

    TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will crash. We have patched the issue in GitHub commit f5381e0e10b5a61344109c1b7c174c68110f7629. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflowPython
    • Auf 2.10.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2022-41880

    Mittel · CVSS 6.8EPSS 0,43%Korrektur verfügbar

    ThreadUnsafeUnigramCandidateSampler Heap out of bounds in Tensorflow

    TensorFlow is an open source platform for machine learning. When the `BaseCandidateSamplerOp` function receives a value in `true_classes` larger than `range_max`, a heap oob read occurs. We have patched the issue in GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.10.1 aktualisieren
    • Auf 2.8.4 aktualisieren
    • Auf 2.9.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2022-36015

    Mittel · CVSS 5.9EPSS 0,7%Korrektur verfügbar

    Integer overflow in math ops in TensorFlow

    TensorFlow is an open source platform for machine learning. When `RangeSize` receives values that do not fit into an `int64_t`, it crashes. We have patched the issue in GitHub commit 37e64539cd29fcfb814c4451152a60f5d107b0f0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2022-36012

    Mittel · CVSS 5.9EPSS 0,7%Korrektur verfügbar

    Assertion fail on MLIR empty edge names in TensorFlow

    TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it crashes. We have patched the issue in GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2022-35996

    Mittel · CVSS 5.9EPSS 0,48%Korrektur verfügbar

    Floating point exception in `Conv2D` in TensorFlow

    TensorFlow is an open source platform for machine learning. If `Conv2D` is given empty `input` and the `filter` and `padding` sizes are valid, the output is all-zeros. This causes division-by-zero floating point exceptions that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 611d80db29dd7b0cfb755772c69d60ae5bca05f9. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2022-36027

    Mittel · CVSS 5.9EPSS 0,77%Korrektur verfügbar

    Segfault TFLite converter on per-channel quantized transposed convolutions in TensorFlow

    TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. We have patched the issue in GitHub commit aa0b852a4588cea4d36b74feb05d93055540b450. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2022-36017

    Mittel · CVSS 5.9EPSS 0,51%Korrektur verfügbar

    Segfault in `Requantize` in TensorFlow

    TensorFlow is an open source platform for machine learning. If `Requantize` is given `input_min`, `input_max`, `requested_output_min`, `requested_output_max` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2022-36014

    Mittel · CVSS 5.9EPSS 0,72%Korrektur verfügbar

    Null-dereference in `mlir::tfg::TFOp::nameAttr` in TensorFlow

    TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receives null type list attributes, it crashes. We have patched the issue in GitHub commits 3a754740d5414e362512ee981eefba41561a63a6 and a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2022-36000

    Mittel · CVSS 5.9EPSS 0,48%Korrektur verfügbar

    Null dereference on MLIR on empty function attributes in TensorFlow

    TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit aed36912609fc07229b4d0a7b44f3f48efc00fd0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2022-36011

    Mittel · CVSS 5.9EPSS 0,48%Korrektur verfügbar

    Null dereference on MLIR on empty function attributes in TensorFlow

    TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2022-36013

    Mittel · CVSS 5.9EPSS 0,7%Korrektur verfügbar

    Null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef` in TensorFlow

    TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2022-35994

    Mittel · CVSS 5.9EPSS 0,48%Korrektur verfügbar

    `CHECK` fail in `CollectiveGather` in TensorFlow

    TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scalar input `input`, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c1f491817dec39a26be3c574e86a88c30f3c4770. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2022-35993

    Mittel · CVSS 5.9EPSS 0,48%Korrektur verfügbar

    `CHECK` fail in `SetSize` in TensorFlow

    TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit cf70b79d2662c0d3c6af74583641e345fc939467. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

    tensorflow tensorflow tensorflow tensorflowPython
    • Auf 2.7.2 aktualisieren
    • Auf 2.8.1 aktualisieren
    • Auf 2.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →