Vulnerabilities for tensorflow-cpu

First version without a known vulnerability: 2.13.0rc0

Details

• GHSA-gjh7-xx4r-x3452024-07-30

  TensorFlow has segfault in array_ops.upper_bound

  Fixed in: 2.12.1

• GHSA-fxgc-95xx-grvq2023-03-27

  TensorFlow Denial of Service vulnerability

  Fixed in: 2.11.1

• GHSA-93vr-9q9m-pj8p2023-03-24

  TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch

  Fixed in: 2.11.1

• GHSA-qjqc-vqcf-5qvj2023-03-24

  TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`

  Fixed in: 2.11.1

• GHSA-7jvm-xxmr-v5cw2023-03-24

  TensorFlow vulnerable to integer overflow in EditDistance

  Fixed in: 2.11.1

• GHSA-64jg-wjww-7c5w2023-03-24

  TensorFlow has Null Pointer Error in TensorArrayConcatV2

  Fixed in: 2.11.1

• GHSA-6hg6-5c2q-7rcr2023-03-24

  TensorFlow has Heap-buffer-overflow in AvgPoolGrad

  Fixed in: 2.11.1

• GHSA-558h-mq8x-7q9g2023-03-24

  TensorFlow has Null Pointer Error in SparseSparseMaximum

  Fixed in: 2.11.1

• GHSA-f637-vh3r-vfh22023-03-24

  TensorFlow has Floating Point Exception in AudioSpectrogram

  Fixed in: 2.11.1

• GHSA-fqm2-gh8w-gr682023-03-24

  TensorFlow vulnerable to segfault when opening multiframe gif

  Fixed in: 2.11.1

• GHSA-gw97-ff7c-9v962023-03-24

  TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

  Fixed in: 2.11.1

• GHSA-rcf8-g8jv-vg6p2023-03-24

  TensorFlow has Floating Point Exception in AvgPoolGrad with XLA

  Fixed in: 2.11.1

• GHSA-49rq-hwc3-x77w2023-03-24

  TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize

  Fixed in: 2.11.1

• GHSA-j5w9-hmfh-4cr62023-03-24

  TensorFlow has segmentation fault in tfg-translate

  Fixed in: 2.11.1

• GHSA-94mm-g2mv-8p7r2023-03-24

  TensorFlow has Null Pointer Error in LookupTableImportV2

  Fixed in: 2.11.1

• GHSA-647v-r7qq-24fh2023-03-24

  TensorFlow has Floating Point Exception in TensorListSplit with XLA

  Fixed in: 2.11.1

• GHSA-gf97-q72m-75792023-03-24

  TensorFlow has Null Pointer Error in RandomShuffle with XLA enable

  Fixed in: 2.11.1

• GHSA-7x4v-9gxg-9hwj2023-03-24

  TensorFlow has Segfault in Bincount with XLA

  Fixed in: 2.11.1

• GHSA-6wfh-89q8-44jq2023-03-24

  TensorFlow has null dereference on ParallelConcat with XLA

  Fixed in: 2.11.1

• GHSA-f49c-87jh-g47q2023-03-24

  TensorFlow has double free in Fractional(Max/Avg)Pool

  Fixed in: 2.11.1

• GHSA-5w96-866f-6rm82023-03-24

  TensorFlow has Floating Point Exception in TFLite in conv kernel

  Fixed in: 2.11.1

• GHSA-68v3-g9cm-rmm62023-03-24

  TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad

  Fixed in: 2.11.1

• GHSA-8w5g-3wcv-9g2j2022-11-22

  Tensorflow vulnerable to Out-of-Bounds Read

  Fixed in: 2.10.1, 2.8.4, 2.9.3

• GHSA-cqvq-fvhr-v6hc2022-11-21

  `CHECK` failure in `SobolSample` via missing validation

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-xf83-q765-xm6m2022-11-21

  `CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-pf36-r9c6-h97j2022-11-21

  Invalid char to bool conversion when printing a tensor

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-frqp-wp83-qggv2022-11-21

  Heap overflow in `QuantizeAndDequantizeV2`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-rjx6-v474-2ch92022-11-21

  Segfault in `CompositeTensorVariantToComponents`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-mv77-9g28-cwg32022-11-21

  `CHECK` fail via inputs in `PyFunc`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-368v-7v32-52fx2022-11-21

  Overflow in `ResizeNearestNeighborGrad`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-cg88-rpvp-cjv52022-11-21

  Out of bounds write in grappler in Tensorflow

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-g9fm-r5mm-rf9f2022-11-21

  `CHECK_EQ` fail via input in `SparseMatrixNNZ`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-xvwp-h6jv-74722022-11-21

  FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-27rc-728f-x5w22022-11-21

  `CHECK` fail via inputs in `SdcaOptimizer`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-hq7g-wwwp-q46h2022-11-21

  `CHECK` fail via inputs in `SparseFillEmptyRowsGrad`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-f2w8-jw48-fr7j2022-11-21

  `FractionalMaxPoolGrad` Heap out of bounds read

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-rmg2-f698-wq352022-11-21

  `tf.raw_ops.Mfcc` crashes

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-gq2j-cr96-gvqx2022-11-21

  `MirrorPadGrad` heap out of bounds read

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-67pf-62xr-q35m2022-11-21

  `CHECK_EQ` fail in `tf.raw_ops.TensorListResize`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-66vq-54fq-6jvv2022-11-21

  Segfault in `tf.raw_ops.TensorListConcat`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-h246-cgh4-74752022-11-21

  `CHECK` fail in `BCast` overflow

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-xxcj-rhqg-m46g2022-11-21

  Segfault via invalid attributes in `pywrap_tfe_src.cc`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-6x99-gv2v-q76v2022-11-21

  FPE in `tf.image.generate_bounding_box_proposals`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-8fvv-46hw-vpg32022-11-21

  Overflow in `tf.keras.losses.poisson`

  Fixed in: 2.9.3, 2.10.1

• GHSA-54pp-c6pp-7fpx2022-11-21

  Overflow in `ImageProjectiveTransformV2`

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-762h-vpvw-3rcx2022-11-21

  Overflow in `FusedResizeAndPadConv2D`

  Fixed in: 2.7.4, 2.8.1, 2.9.1

• GHSA-jq6x-99hj-q6362022-11-21

  Seg fault in `ndarray_tensor_bridge` due to zero and large inputs

  Fixed in: 2.8.4, 2.9.3, 2.10.1

• GHSA-w58w-79xv-6vcj2022-11-21

  Out of bounds segmentation fault due to unequal op inputs in Tensorflow

  Fixed in: 2.10.1

• GHSA-9jjw-hf72-3mxw2022-10-07

  TensorFlow vulnerable to heap out of bounds read in filesystem glob matching

  Fixed in: 2.4.0, 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c

• GHSA-m6vp-8q9j-whx42022-09-16

  TensorFlow vulnerable to `CHECK` fail in `Save` and `SaveSlices`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-p2xf-8hgm-hpw52022-09-16

  TensorFlow vulnerable to `CHECK` fail in `ParameterizedTruncatedNormal`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-9942-r22v-78cp2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `LRNGrad`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-9vqj-64pv-w55c2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `tf.linalg.matrix_rank`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-j43h-pgmg-5hjq2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `MaxPool`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-397c-5g2j-qxpv2022-09-16

  TensorFlow vulnerable to segfault in `SparseBincount`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-vxv8-r8q2-63xw2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `FractionalMaxPoolGrad`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-v7vw-577f-vp8x2022-09-16

  TensorFlow vulnerable to segfault in `QuantizedRelu` and `QuantizedRelu6`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-vgvh-2pf4-jr2x2022-09-16

  TensorFlow vulnerable to segfault in `QuantizeDownAndShrinkRange`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-689c-r7h2-fv9v2022-09-16

  TensorFlow vulnerable to segfault in `QuantizedMatMul`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-4pc4-m9mj-v2r92022-09-16

  TensorFlow vulnerable to segfault in `QuantizedBiasAdd`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-9fpg-838v-wpv72022-09-16

  TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVars`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-g35r-369w-3fqp2022-09-16

  TensorFlow vulnerable to segfault in `QuantizedInstanceNorm`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-q2c3-jpmc-gfjx2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `Conv2DBackpropInput`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-2475-53vw-vp252022-09-16

  TensorFlow vulnerable to `CHECK` fail in `AvgPoolGrad`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-v6h3-348g-6h5x2022-09-16

  TensorFlow vulnerable to segfault in `QuantizedAdd`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-4w68-4x85-mjj92022-09-16

  TensorFlow vulnerable to segfault in `QuantizedAvgPool`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-h7ff-cfc9-wmmh2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannelGradient`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-vm7x-4qhj-rrcq2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `TensorListScatter` and `TensorListScatterV2`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-qxpx-j395-pw362022-09-16

  TensorFlow vulnerable to segfault in `LowerBound` and `UpperBound`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-9v8w-xmr4-wgxp2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `TensorListFromTensor`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-wq6q-6m32-9rv92022-09-16

  TensorFlow vulnerable to `CHECK` fail in `SetSize`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-f7r5-q7cx-h6682022-09-16

  TensorFlow vulnerable to segfault in `BlockLSTMGradV2`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-84jm-4cf3-9jfm2022-09-16

  TensorFlow vulnerable to `CHECK` failures in `FractionalAvgPoolGrad`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-h5vq-gw2c-pq472022-09-16

  TensorFlow vulnerable to `CHECK` failures in `UnbatchGradOp`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-x989-q2pq-4q5x2022-09-16

  TensorFlow vulnerable to Int overflow in `RaggedRangeOp`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-fhfc-2q7x-929f2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `CollectiveGather`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-v5xg-3q2c-c2r42022-09-16

  TensorFlow vulnerable to `CHECK` failure in `TensorListReserve` via missing validation

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-q5jv-m6qw-5g372022-09-16

  TensorFlow vulnerable to floating point exception in `Conv2D`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-wxjj-cgcx-r3vq2022-09-16

  TensorFlow vulnerable to `CHECK` failures in `AvgPool3DGrad`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-fqxc-pvf8-2w9v2022-09-16

  TensorFlow vulnerable to null dereference on MLIR on empty function attributes

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-jqm7-m5q7-3hm52022-09-16

  TensorFlow vulnerable to `CHECK` fail in `DrawBoundingBoxes`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-mh3m-62v7-68xg2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `Unbatch`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-828c-5j5q-vrjq2022-09-16

  TensorFlow vulnerable to null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-fv43-93gv-vm8f2022-09-16

  TensorFlow vulnerable to null dereference on MLIR on empty function attributes

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-wqmc-pm8c-2jhc2022-09-16

  TensorFlow vulnerable to segfault in `Requantize`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-cv2p-32v3-vhwq2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `RandomPoissonV2`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-r26c-679w-mrjm2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsGradient`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-g9h5-vr8m-x2h42022-09-16

  TensorFlow vulnerable to `CHECK` fail in `AudioSummaryV2`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-mv8m-8x97-937q2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `tf.random.gamma`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-g468-qj8g-vcjc2022-09-16

  TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-7j3m-8g3c-9qqq2022-09-16

  TensorFlow vulnerable to null-dereference in `mlir::tfg::TFOp::nameAttr`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-rh87-q4vg-m45j2022-09-16

  TensorFlow vulnerable to integer overflow in math ops

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-jvhc-5hhr-w3v52022-09-16

  TensorFlow vulnerable to assertion fail on MLIR empty edge names

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-w62h-8xjm-fv492022-09-16

  TensorFlow vulnerable to `CHECK` fail in `DenseBincount`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-mgmh-g2v6-mqw52022-09-16

  TensorFlow vulnerable to `CHECK` failure in `AvgPoolOp`

  Fixed in: 2.7.2, 2.8.1, 2.9.2

• GHSA-9cr2-8pwr-fhfq2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `QuantizeAndDequantizeV3`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-m6cv-4fmf-66xf2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `RaggedTensorToVariant`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-9j4v-pp28-mxv72022-09-16

  TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-79h2-q768-fpxr2022-09-16

  TensorFlow segfault TFLite converter on per-channel quantized transposed convolutions

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-ffjm-4qwc-7cmf2022-09-16

  TensorFlow vulnerable to OOB write in `scatter_nd` in TF Lite

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-pxrw-j2fv-hx3h2022-09-16

  TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-f4w6-h4f5-wx452022-09-16

  TensorFlow vulnerable to `CHECK` failure in tf.reshape via overflows

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-97p7-w86h-vcf92022-09-16

  TensorFlow vulnerable to `CHECK` failure in `SobolSample` via missing validation

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-p7hr-f446-x6qf2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `tf.sparse.cross`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-37jf-mjv6-xfqw2022-09-16

  TensorFlow vulnerable to `CHECK` fail in `Conv2DBackpropInput`

  Fixed in: 2.7.2, 2.8.1, 2.9.1

• GHSA-mw6j-hh29-h3792022-05-25

  `CHECK` failure in depthwise ops via overflows

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-75c9-jrh4-79mc2022-05-24

  Code injection in `saved_model_cli` in TensorFlow

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-5889-7v45-q28m2022-05-24

  Incomplete validation in signal ops leads to crashes in TensorFlow

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-8wwm-6264-x7922022-05-24

  Core dump when loading TFLite models with quantization in TensorFlow

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-xrp2-fhq4-4q3w2022-05-24

  Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-hc2f-7r5r-r2hg2022-05-24

  Heap buffer overflow due to incorrect hash function in TensorFlow

  Fixed in: 2.8.1

• GHSA-f4rr-5m7v-wxcw2022-05-24

  Type confusion leading to `CHECK`-failure based denial of service in TensorFlow

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-2r2f-g8mw-9gvr2022-05-24

  Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlow

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-5wpj-c6f7-24x82022-05-24

  Undefined behavior when users supply invalid resource handles

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-rc9w-5c64-9vqq2022-05-24

  Missing validation results in undefined behavior in `SparseTensorDenseAdd

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-54ch-gjq5-49762022-05-24

  Segfault due to missing support for quantized types

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-hx9q-2mx4-m4pg2022-05-24

  Missing validation causes denial of service via `Conv3DBackpropFilterV2`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-jjm6-4vf7-cjh42022-05-24

  Integer overflow in `SpaceToBatchND`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-cwpm-f78v-7m5c2022-05-24

  Denial of service in `tf.ragged.constant` due to lack of validation

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-pqhm-4wvf-2jg82022-05-24

  Missing validation results in undefined behavior in `QuantizedConv2D`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-2vv3-56qg-g2cf2022-05-24

  Missing validation causes denial of service via `LSTMBlockCell`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-p9rc-rmr5-529j2022-05-24

  Missing validation causes denial of service via `LoadAndRemapMatrix`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-mg66-qvc5-rm932022-05-24

  Missing validation causes denial of service via `SparseTensorToCSRSparseMatrix`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-hrg5-737c-2p562022-05-24

  Missing validation causes denial of service via `UnsortedSegmentJoin`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-5v77-j66x-4c4g2022-05-24

  Missing validation causes denial of service via `Conv3DBackpropFilterV2`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-h48f-q7rw-hvr72022-05-24

  Missing validation causes denial of service via `StagePeek`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-h5g4-ppwx-48q22022-05-24

  Missing validation causes denial of service via `DeleteSessionTensor`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-h2wq-prv9-2f562022-05-24

  Missing validation crashes `QuantizeAndDequantizeV4Grad`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-fv25-wrff-wf862022-05-24

  Missing validation causes denial of service via `GetSessionTensor`

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-2p9q-h29j-3f5v2022-05-24

  Missing validation causes `TensorSummaryV2` to crash

  Fixed in: 2.6.4, 2.7.2, 2.8.1

• GHSA-gv26-jpj9-c8gq2022-03-18

  Incomplete validation in `SparseSparseMinimum`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ba6822bd7b7324ba201a28b2f278c29a98edbef2, f6fde895ef9c77d848061c0517f19d0ec2682f3a

• GHSA-gjqc-q9g6-q2j32022-02-10

  `CHECK`-failures in binary ops in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, a7c02f1a9bbc35473969618a09ee5f9f5d3e52d9

• GHSA-4j82-5ccr-4r8v2022-02-10

  `CHECK`-failures in `TensorByteSize` in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, c2426bba00a01de6913738df8fa78e0215fcce02

• GHSA-5f2r-qp73-37mr2022-02-10

  `CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 92dba16749fae36c246bec3f9ba474d9ddeb7662

• GHSA-8r7c-3cm2-3h8f2022-02-10

  Memory leak in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, c79ccba517dbb1a0ccb9b01ee3bd2a63748b60dd

• GHSA-c94w-c95p-phf82022-02-10

  Integer overflow in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, fcd18ce3101f245b083b30655c27b239dc72221e

• GHSA-wm93-f238-7v372022-02-10

  Integer overflow in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae

• GHSA-8cxv-76p7-jxwr2022-02-10

  Null-dereference in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 4f38b1ac8e42727e18a2f0bde06d3bee8e77b250

• GHSA-87v6-crgm-2gfj2022-02-10

  Division by zero in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb

• GHSA-gcvh-66ff-4mwm2022-02-10

  `CHECK`-failures in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, f57315566d7094f322b784947093406c2aea0d7d

• GHSA-98j8-c9q4-r38g2022-02-10

  Memory exhaustion in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, f68fdab93fb7f4ddb4eb438c8fe052753c9413e8

• GHSA-c582-c96p-r5cq2022-02-10

  Memory exhaustion in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, e3749a6d5d1e8d11806d4a2e9cc3123d1a90b75e

• GHSA-m4hf-j54p-p3532022-02-10

  Type confusion leading to segfault in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 08d7b00c0a5a20926363849f611729f53f3ec022

• GHSA-34f9-hjfq-rr8j2022-02-10

  Overflow and uncaught divide by zero in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 58b34c6c8250983948b5a781b426f6aa01fd47af

• GHSA-v3f7-j968-4h5f2022-02-10

  Division by zero in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 3218043d6d3a019756607643cf65574fbfef5d7a

• GHSA-24x4-6qmh-88qg2022-02-09

  Use after free in `DecodePng` kernel

  Fixed in: 2.5.3, 2.6.3, 2.7.1, e746adbfcfee15e9cfdb391ff746c765b99bdf9b

• GHSA-5qw5-89mw-wcg22022-02-09

  Out of bounds write in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 97282c6d0d34476b6ba033f961590b783fa184cd

• GHSA-8rcj-c8pj-v3m32022-02-09

  Reachable Assertion in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 14fea662350e7c26eb5fe1be2ac31704e5682ee6

• GHSA-wc4g-r73w-x8mm2022-02-09

  Insecure temporary file in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1

• GHSA-qx3f-p745-w4hr2022-02-09

  Integer overflow in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, f0147751fd5d2ff23251149ebad9af9f03010732

• GHSA-9c78-vcq7-7vxq2022-02-09

  Out of bounds write in TFLite

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 6c0b2b70eeee588591680f5b7d5d38175fd7cdf6

• GHSA-4hvf-hxvg-f67v2022-02-09

  Read and Write outside of bounds in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 6364463d6f5b6254cac3d6aedf999b6a96225038

• GHSA-98p5-x8x4-c9m52022-02-09

  Integer overflow in TFLite

  Fixed in: 2.5.3, 2.6.3, 2.7.1, a4e401da71458d253b05e41f28637b65baf64be4, 1de49725a5fc4e48f1a3b902ec3599ee99283043, f19be71717c497723ba0cea0379e84f061a75e01

• GHSA-9gwq-6cwj-47h32022-02-09

  Integer overflow in TFLite array creation

  Fixed in: 2.5.3, 2.6.3, 2.7.1, a1e1511dde36b3f8aa27a6ec630838e7ea40e091

• GHSA-4v5p-v5h9-6xjx2022-02-09

  `CHECK`-failures in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, c2b31ff2d3151acb230edc3f5b1832d2c713a9e0

• GHSA-gf2j-f278-xh4v2022-02-09

  Division by zero in TFLite

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 8c6f391a2282684a25cbfec7687bd5d35261a209

• GHSA-428x-9xc2-m8mj2022-02-09

  Division by zero in TFLite

  Fixed in: 2.5.3, 2.6.3, 2.7.1, e5b0eec199c2d03de54fd6a7fd9275692218e2bc

• GHSA-44qp-9wwf-734r2022-02-09

  Heap overflow in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 2b7100d6cdff36aa21010a82269bc05a6d1cc74a, adbbabdb0d3abb3cdeac69e38a96de1d678b24b3

• GHSA-3mw4-6rj6-74g52022-02-09

  Null pointer dereference in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 53b0dd6dc5957652f35964af16b892ec9af4a559

• GHSA-x4qx-4fjv-hmw62022-02-09

  Integer overflow leading to crash in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 6f4d3e8139ec724dbbcb40505891c81dd1052c4a

• GHSA-f2vv-v9cg-qhh72022-02-09

  Assertion failure based denial of service in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 7019ce4f68925fd01cdafde26f8d8c938f47e6f9

• GHSA-pfjj-m3jj-9jc92022-02-09

  Undefined behavior in `SparseTensorSliceDataset`

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 965b97e4a9650495cda5a8c210ef6684b4b9eceb

• GHSA-rrx2-r989-2c432022-02-09

  Integer overflows in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, e952a89b7026b98fe8cbe626514a93ed68b7c510, 1b54cadd19391b60b6fcccd8d076426f7221d5e8

• GHSA-6445-fm66-fvq22022-02-09

  Integer overflows in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, b51b82fe65ebace4475e3c54eb089c18a4403f1c, a68f68061e263a88321c104a6c911fe5598050a8

• GHSA-qj5r-f9mv-rffh2022-02-09

  `CHECK`-fails when building invalid tensor shapes in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1

• GHSA-h6gw-r52c-724r2022-02-09

  NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1

• GHSA-43q8-3fv7-pr5x2022-02-09

  Improper Validation of Integrity Check Value in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1

• GHSA-wcv5-vrvr-3rx22022-02-09

  Integer Overflow or Wraparound in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1

• GHSA-9p77-mmrw-69c72022-02-09

  Null-dereference in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 8a513cec4bec15961fbfdedcaa5376522980455c

• GHSA-fpcp-9h7m-ffpx2022-02-09

  Null pointer dereference in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, e21af685e1828f7ca65038307df5cc06de4479e8

• GHSA-9x52-887g-fhc22022-02-09

  Out of bounds read in Tensorflow

  Fixed in: 2.7.1

• GHSA-gwcx-jrx4-92w22022-02-09

  Segfault in `simplifyBroadcast` in Tensorflow

  Fixed in: 2.8.0, 35f0fabb4c178253a964d7aabdbb15c6a398b69a

• GHSA-vq36-27g6-p4922022-02-09

  Out of bounds read in Tensorflow

  Fixed in: 2.8.0, c99d98cd189839dcf51aee94e7437b54b31f8abd

• GHSA-247x-2f9f-5wp72022-02-09

  Stack overflow in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 448a16182065bd08a202d9057dd8ca541e67996c

• GHSA-pqrv-8r2f-72782022-02-09

  Crash due to erroneous `StatusOr` in TensorFlow

  Fixed in: 2.7.1, 955059813cc325dc1db5e2daa6221271406d4439

• GHSA-9px9-73fg-3fqp2022-02-09

  Null pointer dereference in Grappler's `IsConstant`

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 0a365c029e437be0349c31f8d4c9926b69fa3fa1, 045deec1cbdebb27d817008ad5df94d96a08b1bf

• GHSA-j3mj-fhpq-qqjj2022-02-09

  Reachable Assertion in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 5b491cd5e41ad63735161cec9c2a568172c8b6a3

• GHSA-rww7-2gpw-fv6j2022-02-09

  Crash when type cannot be specialized in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, cb164786dc891ea11d3a900e90367c339305dc7b

• GHSA-fx5c-h9f6-rv7c2022-02-09

  `CHECK`-fails due to attempting to build a reference tensor

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 6b5adc0877de832b2a7c189532dbbbc64622eeb6

• GHSA-8jj7-5vxc-pg2q2022-02-09

  Integer overflow in TensorFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 0aaaae6eca5a7175a193696383f582f53adab23f

• GHSA-43jf-985q-588j2022-02-09

  Multiple `CHECK`-fails in `function.cc` in TensowFlow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 3d89911481ba6ebe8c88c1c0b595412121e6c645, dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2

• GHSA-q85f-69q7-55h22022-02-09

  Uninitialized variable access in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, ef1d027be116f25e25bb94a60da491c2cf55bd0b

• GHSA-fq6p-6334-8gr42022-02-09

  Memory leak in decoding PNG images

  Fixed in: 2.5.3, 2.6.3, 2.7.1, ab51e5b813573dc9f51efa335aebcf2994125ee9

• GHSA-77gp-3h4r-64282022-02-09

  Out of bounds read and write in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 0657c83d08845cc434175934c642299de2c0f042

• GHSA-vjg4-v33c-ggc42022-02-09

  Out of bounds read in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 002408c3696b173863228223d535f9de72a101a9

• GHSA-6gmv-pjp9-p8w82022-02-09

  Out of bounds read in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 37c01fb5e25c3d80213060460196406c43d31995

• GHSA-c6fh-56w7-fvjw2022-02-09

  Integer overflow in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, b64638ec5ccaa77b7c1eb90958e3d85ce381f91b

• GHSA-23hm-7w47-xw722022-02-09

  Out of bounds read in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 23968a8bf65b009120c43b5ebcceaf52dbc9e943

• GHSA-627q-g293-49q72022-02-07

  Abort caused by allocating a vector that is too large in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 1361fb7e29449629e1df94d44e0427ebec8c83c7

• GHSA-fq86-3f29-px2c2022-02-07

  `CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow

  Fixed in: 2.5.3, 2.6.3, 2.7.1, 1fb27733f943295d874417630edd3b38b34ce082, 240655511cd3e701155f944a972db71b6c0b1bb6, ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1

• GHSA-57wx-m983-2f882021-11-10

  Incomplete validation in boosted trees code

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 5c8c9a8bfe750f9743d0c859bae112060b216f5c, 2.7.0

• GHSA-cq76-mxrc-vchh2021-11-10

  Crash in `tf.math.segment_*` operations

  Fixed in: 2.6.1, 2.5.2, 2.4.4, e9c81c1e1a9cd8dd31f4e83676cab61b60658429

• GHSA-m539-j985-hcr82021-11-10

  Crash in `max_pool3d` when size argument is 0 or negative

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 12b1ff82b3f26ff8de17e58703231d5a02ef1b8b, 2.7.0

• GHSA-prcg-wp5q-rv7p2021-11-10

  Crashes due to overflow and `CHECK`-fail in ops with large tensor shapes

  Fixed in: 2.6.1, 2.5.2, 2.4.4, a871989d7b6c18cdebf2fb4f0e5c5b62fbc19edf, d81b1351da3e8c884ff836b64458d94e4a157c15, 7c1692bd417eb4f9b33ead749a41166d6080af85, 2.7.0

• GHSA-2p25-55c9-h58q2021-11-10

  Overflow/crash in `tf.tile` when tiling tensor is large

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 9294094df6fea79271778eb7e7ae1bad8b5ef98f, 2.7.0

• GHSA-5hx2-qx8j-qjqm2021-11-10

  Overflow/crash in `tf.image.resize` when size is large

  Fixed in: 2.6.1, 2.5.2, 2.4.4, e5272d4204ff5b46136a1ef1204fc00597e21837, 2.7.0

• GHSA-gh8h-7j2j-qv4f2021-11-10

  Incomplete validation in `tf.summary.create_file_writer`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 874bda09e6702cd50bac90b453b50bcc65b2769e, 2.7.0

• GHSA-j86v-p27c-73fm2021-11-10

  Unitialized access in `EinsumHelper::ParseEquation`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, f09caa532b6e1ac8d2aa61b7832c78c5b79300c6, 2.7.0

• GHSA-xrqm-fpgr-6hhx2021-11-10

  Overflow/crash in `tf.range`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 1b0e0ec27e7895b9985076eab32445026ae5ca94, 6d94002a09711d297dbba90390d5482b76113899, 2.7.0

• GHSA-7pxj-m4jf-r6h22021-11-10

  Missing validation during checkpoint loading

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 368af875869a204b4ac552b9ddda59f6a46a56ec, abcced051cb1bd8fb05046ac3b6023a7ebcc4578, e8dc63704c88007ee4713076605c90188d66f3d2, b619c6f865715ca3b15ef1842b5b95edbaa710ad, 2.7.0

• GHSA-786j-5qwq-r36x2021-11-10

  Segfault while copying constant resource tensor

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 7731e8dfbe4a56773be5dc94d631611211156659, 2.7.0

• GHSA-49rx-x2rw-pc6f2021-11-10

  Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d, 2.7.0

• GHSA-pgcq-h79j-2f692021-11-10

  Incomplete validation of shapes in multiple TF ops

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 68422b215e618df5ad375bcdc6d2052e9fd3080a, 4d74d8a00b07441cba090a02e0dd9ed385145bf4, 579261dcd446385831fe4f7457d802a59685121d, e7f497570abb6b4ae5af4970620cd880e4c0c904, da4aad5946be30e5f049920fa076e1f7ef021261, 4dddb2fd0b01cdd196101afbba6518658a2c9e07

• GHSA-7v94-64hj-m82h2021-11-10

  FPE in `ParallelConcat`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, f2c3931113eaafe9ef558faaddd48e00a6606235, 2.7.0

• GHSA-6hpv-v2rx-c5g62021-11-10

  FPE in convolutions with zero size filters

  Fixed in: 2.6.1, 2.5.2, 2.4.4, f2c3931113eaafe9ef558faaddd48e00a6606235, 2.7.0

• GHSA-m342-ff57-4jcc2021-11-10

  Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 701cfaca222a82afbeeb17496bd718baa65a67d2, 2.7.0

• GHSA-cvgx-3v3q-m36c2021-11-10

  Heap OOB in shape inference for `QuantizeV2`

  Fixed in: 2.6.1, a0d64445116c43cf46a5666bd4eee28e7a82f244, 2.7.0

• GHSA-fr77-rrx3-cp7g2021-11-10

  Heap OOB read in `tf.ragged.cross`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8, 2.7.0

• GHSA-h67m-xg8f-fxcf2021-11-10

  Deadlock in mutually recursive `tf.function` objects

  Fixed in: 2.6.1, 2.5.2, 2.4.4, afac8158d43691661ad083f6dd9e56f327c1dcb7, 2.7.0

• GHSA-vwhq-49r4-gj9v2021-11-10

  Reference binding to `nullptr` in `tf.ragged.cross`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8, 2.7.0

• GHSA-x3v8-c8qx-3j3r2021-11-10

  Null pointer exception in `DeserializeSparse`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, d3738dd70f1c9ceb547258cbb82d853da8771850, 2.7.0

• GHSA-3ff2-r28g-w7h92021-11-10

  Heap buffer overflow in `Transpose`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, c79ba87153ee343401dbe9d1954d7f79e521eb14, 2.7.0

• GHSA-5crj-c72x-m7gq2021-11-10

  Null pointer exception when `Exit` node is not preceded by `Enter` op

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 05cbebd3c6bb8f517a158b0155debb8df79017ff, 2.7.0

• GHSA-9crf-c6qr-r2732021-11-10

  Integer division by 0 in `tf.raw_ops.AllToAll`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc, 2.7.0

• GHSA-4f99-p9c2-3j8x2021-11-10

  Undefined behavior via `nullptr` reference binding in sparse matrix multiplication

  Fixed in: 2.6.1, 2.5.2, 2.4.4, e6cf28c72ba2eb949ca950d834dd6d66bb01cfae, 2.7.0

• GHSA-gpfh-jvf9-7wg52021-11-10

  Use after free / memory leak in `CollectiveReduceV2`

  Fixed in: 2.6.1, ca38dab9d3ee66c5de06f11af9a4b1200da5ef75, 2.7.0

• GHSA-cqv6-3phm-hcwx2021-11-10

  Access to invalid memory during shape inference in `Cudnn*` ops

  Fixed in: 2.6.1, 2.5.2, 2.4.4, af5fcebb37c8b5d71c237f4e59c6477015c78ce6, 2.7.0

• GHSA-cpf4-wx82-gxp62021-11-10

  Segfault due to negative splits in `SplitV`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 25d622ffc432acc736b14ca3904177579e733cc6, 2.7.0

• GHSA-f54p-f6jp-4rhr2021-11-10

  Heap OOB in `FusedBatchNorm` kernels

  Fixed in: 2.6.1, 2.5.2, 2.4.4, aab9998916c2ffbd8f0592059fad352622f89cda, 2.7.0

• GHSA-rg3m-hqc5-344v2021-11-10

  `SparseFillEmptyRows` heap OOB

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 67bfd9feeecfb3c61d80f0e46d89c170fbee682b, 2.7.0

• GHSA-7r94-xv9v-63jw2021-11-10

  A use of uninitialized value vulnerability in Tensorflow

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 68867bf01239d9e1048f98cbad185bf4761bedd3, 2.7.0

• GHSA-374m-jm66-3vj82021-11-10

  Heap OOB in `SparseBinCount`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, f410212e373eb2aec4c9e60bf3702eba99a38aba, 2.7.0

• GHSA-j8c8-67vp-6mx72021-11-10

  Arbitrary memory read in `ImmutableConst`

  Fixed in: 2.6.1, 2.5.2, 2.4.4, 3712a2d3455e6ccb924daa5724a3652a86f6b585, 1cb6bb6c2a6019417c9adaf9e6843ba75ee2580b, 2.7.0

• GHSA-3rcw-9p9x-582v2021-11-10

  Code injection in `saved_model_cli`

  Fixed in: 2.5.2, 2.4.4, 2.6.1, 8b202f08d52e8206af2bdb2112a62fafbc546ec7, 2.7.0

• GHSA-cgfm-62j4-v4rf2021-08-25

  Heap out of bounds access in sparse reduction operations

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 87158f43f05f2720a374f3e6d22a7aaa3a33f750

• GHSA-hp4c-x6r7-65552021-08-25

  Floating point exception in `SparseDenseCwiseDiv`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, d9204be9f49520cdaaeb2541d1dc5187b23f31d9

• GHSA-c9qf-r67m-p7cg2021-08-25

  Null pointer dereference in `CompressElement`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 5dc7f6981fdaf74c8c5be41f393df705841fb7c5

• GHSA-hwr7-8gxx-fj5p2021-08-25

  Null pointer dereference in `RaggedTensorToTensor`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 301ae88b331d37a2a16159b65b255f4f9eb39314

• GHSA-gh6x-4whr-2qv42021-08-25

  Null pointer dereference and heap OOB read in operations restoring tensors

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 9e82dce6e6bd1f36a57e08fa85af213e2b2f2622

• GHSA-95xm-g58g-3p882021-08-25

  Integer division by 0 in sparse reshaping

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 4923de56ec94fff7770df259ab7f2288a74feb41

• GHSA-9c8h-vvrj-w2p82021-08-25

  Heap OOB in `RaggedGather`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, a2b743f6017d7b97af1fe49087ae15f0ac634373

• GHSA-ch4f-829c-v5pw2021-08-25

  Division by 0 in `ResourceScatterDiv`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 4aacb30888638da75023e6601149415b39763d76

• GHSA-fcwc-p4fc-c5cc2021-08-25

  Null pointer dereference in `MatrixDiagPartOp`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 482da92095c4d48f8784b1f00dda4f81c28d2988

• GHSA-27j5-4p9v-pp672021-08-25

  `std::abort` raised from `TensorListReserve`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 8a6e874437670045e6c7dc6154c7412b4a2135e2

• GHSA-9w2p-5mgw-p94c2021-08-25

  Integer overflow due to conversion to unsigned

  Fixed in: 2.4.3, 2.5.1, 96f364a1ca3009f98980021c4b32be5fdcca33a1, 2.3.4

• GHSA-h6jh-7gv5-28vg2021-08-25

  Bad alloc in `StringNGrams` caused by integer conversion

  Fixed in: 2.3.4, 2.4.3, 2.5.1, c283e542a3f422420cfdb332414543b62fc4e4a5

• GHSA-c5x2-p679-95wc2021-08-25

  Null pointer dereference in `SparseTensorSliceDataset`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 02cc160e29d20631de3859c6653184e3f876b9d7

• GHSA-wp77-4gmm-7cq82021-08-25

  Incorrect validation of `SaveV2` inputs

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 9728c60e136912a12d99ca56e106b7cce7af5986

• GHSA-6gv8-p3vj-pxvr2021-08-25

  Null pointer dereference in `UncompressElement`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 7bdf50bb4f5c54a4997c379092888546c97c3ebd

• GHSA-f8h4-7rgh-q2gm2021-08-25

  Segfault and heap buffer overflow in `{Experimental,}DatasetToTFRecord`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, e0b6e58c328059829c3eb968136f17aa72b6c876

• GHSA-hpv4-7p9c-mvfr2021-08-25

  Heap buffer overflow in `FractionalAvgPoolGrad`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 0f931751fb20f565c4e94aa6df58d54a003cdb30

• GHSA-m7fm-4jfh-jrg62021-08-25

  Use after free in boosted trees creation

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 5ecec9c6fbdbc6be03295685190a45e7eee726ab

• GHSA-qjj8-32p7-h2892021-08-25

  Division by 0 in `ResourceGather`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, ac117ee8a8ea57b73d34665cdf00ef3303bc0b11

• GHSA-2r8p-fg3c-wcj42021-08-25

  Heap OOB and CHECK fail in `ResourceGather`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, bc9c546ce7015c57c2f15c168b3d9201de679a1d

• GHSA-7fvx-3jfc-2cpc2021-08-25

  Heap OOB in `ResourceScatterUpdate`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 01cff3f986259d661103412a20745928c727326f

• GHSA-4xfp-4pfp-89wg2021-08-25

  Reference binding to nullptr in `RaggedTensorToSparse`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 1071f554dbd09f7e101324d366eec5f4fe5a3ece

• GHSA-5xwc-mrhx-5g3m2021-08-25

  Reference binding to nullptr in `MatrixDiagV*` ops

  Fixed in: 2.3.4, 2.4.3, 2.5.1, f2a673bd34f0d64b8e40a551ac78989d16daad09

• GHSA-6p5r-g9mq-ggh22021-08-25

  Reference binding to nullptr in `MatrixSetDiagV*` ops

  Fixed in: 2.3.4, 2.4.3, 2.5.1, ff8894044dfae5568ecbf2ed514c1a37dc394f1b

• GHSA-q3g3-h9r4-prrc2021-08-25

  Reference binding to nullptr and heap OOB in binary cwise ops

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 93f428fd1768df147171ed674fee1fc5ab8309ec

• GHSA-cm5x-837x-jf3c2021-08-25

  Division by 0 in inplace operations

  Fixed in: 2.3.4, 2.4.3, 2.5.1, e86605c0a336c088b638da02135ea6f9f6753618

• GHSA-gf88-j2mg-cc822021-08-25

  Crash caused by integer conversion to unsigned

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992

• GHSA-f5cx-5wr3-5qrc2021-08-25

  Reference binding to nullptr in boosted trees

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad, 429f009d2b2c09028647dd4bb7b3f6f414bbaad7

• GHSA-g25h-jr74-qp5j2021-08-25

  Incomplete validation in `QuantizeV2`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 6da6620efad397c85493b8f8667b821403516708

• GHSA-r4c4-5fpq-56wg2021-08-25

  Heap OOB in boosted trees

  Fixed in: 2.3.4, 2.4.3, 2.5.1, e84c975313e8e8e38bb2ea118196369c45c51378

• GHSA-v82p-hv3v-p6qp2021-08-25

  Incomplete validation in MKL requantization

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 9e62869465573cb2d9b5053f1fa02a81fce21d69, 203214568f5bc237603dbab6e1fd389f1572f5c9

• GHSA-w4xf-2pqw-5mq72021-08-25

  Reference binding to nullptr in `RaggedTensorToVariant`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, be7a4de6adfbd303ce08be4332554dff70362612

• GHSA-w74j-v8xh-3w5h2021-08-25

  Reference binding to nullptr in unicode encoding

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 2e0ee46f1a47675152d3d865797a18358881d7a6

• GHSA-2wmv-37vq-52g52021-08-25

  FPE in `tf.raw_ops.UnravelIndex`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, a776040a5e7ebf76eeb7eb923bf1ae417dd4d233

• GHSA-vmjw-c2vp-p33c2021-08-25

  Crash in NMS ops caused by integer conversion to unsigned

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d, b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58

• GHSA-9697-98pf-4rw72021-08-25

  Heap OOB in `UpperBound` and `LowerBound`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 42459e4273c2e47a3232cc16c4f4fff3b3a35c38

• GHSA-qr82-2c78-4m8h2021-08-25

  Reference binding to nullptr in map operations

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 532f5c5a547126c634fefd43bbad1dc6417678ac

• GHSA-5hj3-vjjf-f5m72021-08-25

  Heap OOB in `SdcaOptimizerV2`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, a4e138660270e7599793fa438cd7b2fc2ce215a6

• GHSA-278g-rq84-9hmg2021-08-25

  `CHECK`-fail in `MapStage`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, d7de67733925de196ec8863a33445b73f9562d1d

• GHSA-7ghq-fvr3-pj2x2021-08-25

  Incomplete validation in `MaxPoolGrad`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 136b51f10903e044308cf77117c0ed9871350475

• GHSA-9c8h-2mv3-49ww2021-08-25

  Division by 0 in most convolution operators

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4

• GHSA-v768-w7m9-2vmm2021-08-25

  Reference binding to nullptr in shape inference

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 578e634b4f1c1c684d4b4294f9e5281b2133b3ed

• GHSA-qfpc-5pjr-mh262021-08-25

  Missing validation in shape inference for `Dequantize`

  Fixed in: 2.3.4, 2.4.3, 2.5.1, da857cfa0fde8f79ad0afdbc94e88b5d4bbec764

• GHSA-r6jx-9g48-2r5r2021-08-25

  Arbitrary code execution due to YAML deserialization

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 23d6383eb6c14084a8fc3bdf164043b974818012

• GHSA-g8wg-cjwc-xhhp2021-08-25

  Heap OOB in nested `tf.map_fn` with `RaggedTensor`s

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 4e2565483d0ffcadc719bd44893fb7f609bb5f12

• GHSA-cfpj-3q4c-jhvr2021-08-25

  Division by zero in TFLite

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 718721986aa137691ee23f03638867151f74935f

• GHSA-7xwj-5r4v-429p2021-08-25

  NPE in TFLite

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 5b048e87e4e55990dae6b547add4dae59f4e1c76

• GHSA-4c4g-crqm-xrxw2021-08-25

  Use of unitialized value in TFLite

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 537bc7c723439b9194a358f64d871dd326c18887, 4a91f2069f7145aab6ba2d8cfe41be8a110c18a5, 8933b8a21280696ab119b63263babdb54c298538

• GHSA-rhrq-64mq-hf9h2021-08-25

  FPE in TFLite division operations

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 1e206baedf8bef0334cca3eb92bab134ef525a28

• GHSA-q7f7-544h-67h92021-08-25

  FPE in TFLite pooling operations

  Fixed in: 2.3.4, 2.4.3, 2.5.1

• GHSA-c545-c4f9-rf6v2021-08-25

  Heap OOB in TFLite

  Fixed in: 2.3.4, 2.4.3, 2.5.1, d94ffe08a65400f898241c0374e9edc6fa8ed257

• GHSA-jwf9-w5xm-f4372021-08-25

  Heap OOB in TFLite's `Gather*` implementations

  Fixed in: 2.3.4, 2.4.3, 2.5.1, eb921122119a6b6e470ee98b89e65d721663179d, bb6a0383ed553c286f87ca88c207f6774d5c4a8f

• GHSA-mhhc-q96p-mfm92021-08-25

  Infinite loop in TFLite

  Fixed in: 2.6.0rc2, dfa22b348b70bb89d6d6ec0ff53973bacb4f4695, 2.3.4, 2.4.3

• GHSA-vcjj-9vg7-vf682021-08-25

  Null pointer dereference in TFLite

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 15691e456c7dc9bd6be203b09765b063bf4a380c

• GHSA-wf5p-c75w-w3wh2021-08-25

  Null pointer dereference in TFLite MLIR optimizations

  Fixed in: 2.3.4, 2.4.3, 2.5.1, d6b57f461b39fd1aa8c1b870f1b974aac3554955

• GHSA-3hxh-8cp2-g4hg2021-08-25

  Use after free and segfault in shape inference functions

  Fixed in: 2.3.4, 2.4.3, 2.5.1, ee119d4a498979525046fba1c3dd3f13a039fbb1

• GHSA-27qf-jwm8-g7f32021-08-25

  FPE in LSH in TFLite

  Fixed in: 2.3.4, 2.4.3, 2.5.1, 0575b640091680cfb70f4dd93e70658de43b94f9

• GHSA-cmgw-8vpc-rc592021-08-25

  Segfault on strings tensors with mistmatched dimensions, due to Go code

  Fixed in: 2.5.1, 8721ba96e5760c229217b594f6d2ba332beedf22, 2.3.4, 2.4.3

• GHSA-wvjw-p9f5-vq282021-05-21

  Segfault in `tf.raw_ops.SparseCountSparseOutput`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 82e6203221865de4008445b13c69b6826d2b28d9

• GHSA-xqfj-cr6q-pc8w2021-05-21

  Crash in `tf.transpose` with complex inputs

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-mmq6-q8r3-48fm2021-05-21

  Crash in `tf.strings.substr` due to `CHECK`-fail

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 890f7164b70354c57d40eda52dcdd7658677c09f, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-4hvv-7x94-7vq82021-05-21

  Null dereference in Grappler's `TrySimplify`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, e6340f0665d53716ef3197ada88936c2a5f7a2d3, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-qw5h-7f53-xrp62021-05-21

  Stack overflow in `ParseAttrValue` with nested tensors

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, e07e1c3d26492c06f078c7e5bf2d138043e199c1

• GHSA-8pmx-p244-g88h2021-05-21

  Interpreter crash from `tf.io.decode_raw`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 698e01511f62a3c185754db78ebce0eee1f0184d

• GHSA-vvg4-vgrv-xfr72021-05-21

  Incomplete validation in `tf.raw_ops.CTCLoss`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 14607c0707040d775e06b6817325640cb4b5864c, 4504a081af71514bb1828048363e6540f797005b

• GHSA-2xgj-xhgf-ggjv2021-05-21

  Heap buffer overflow in `BandedTriangularSolve`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ba6822bd7b7324ba201a28b2f278c29a98edbef2, 0ab290774f91a23bebe30a358fde4e53ab4876a0

• GHSA-9rpc-5v9q-5r7f2021-05-21

  Incomplete validation in `SparseReshape`

  Fixed in: 2.3.3, 2.4.2, 1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6, 2.1.4, 2.2.3

• GHSA-mq5c-prh3-3f3h2021-05-21

  Invalid validation in `QuantizeAndDequantizeV2`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-cjc7-49v2-jp642021-05-21

  Incomplete validation in `SparseAdd`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 41727ff06111117bdf86b37db198217fd7a143cc, 6fd02f44810754ae7481838b6a67c5df7f909ca3

• GHSA-rgvq-pcvf-hx752021-05-21

  Heap OOB and null pointer dereference in `RaggedTensorToTensor`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, c4d7afb6a5986b04505aca4466ae1951686c80f6, f94ef358bb3e91d517446454edff6535bcfe8e4a, b761c9b652af2107cfbc33efd19be0ce41daa33e, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-h4pc-gx2w-f2xv2021-05-21

  Heap OOB read in TFLite

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ae2daeb45abfe2c6dda539cf8d0d6f653d3ef412

• GHSA-jf7h-7m85-w2v22021-05-21

  Integer overflow in TFLite memory allocation

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 7c8cc4ec69cd348e44ad6a2699057ca88faad3e5

• GHSA-8rm6-75mf-7r7r2021-05-21

  Division by zero in TFLite's implementation of hashtable lookup

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 5117e0851348065ed59c991562c0ec80d9193db2

• GHSA-crch-j389-5f842021-05-21

  Heap OOB write in TFLite

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, c59c37e7b2d563967da813fa50fe20b21f4da683

• GHSA-rf3h-xgv5-2q392021-05-21

  Division by zero in TFLite's implementation of `DepthwiseConv`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, cbda3c6b2dbbd3fbdc482ff8c0170a78ec2e97d0

• GHSA-9c84-4hx6-xmm42021-05-21

  Integer overflow in TFLite concatentation

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 4253f96a58486ffe84b61c0415bb234a4632ee73

• GHSA-j8qh-3xrq-c8252021-05-21

  Division by zero in TFLite's implementation of `OneHot`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 3ebedd7e345453d68e279cfc3e4072648e5e12e5

• GHSA-97wf-p777-86jq2021-05-21

  Division by zero in TFLite's implementation of Split

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, b22786e7e9b7bdb6a56936ff29cc7e9968d7bc1d

• GHSA-pmpr-55fj-r2292021-05-21

  Division by zero in TFLite's implementation of `SVDF`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 6841e522a3e7d48706a02e8819836e809f738682

• GHSA-v52p-hfjf-wg882021-05-21

  Division by zero in TFLite's implementation of `SpaceToBatchNd`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 6d36ba65577006affb272335b7c1abd829010708

• GHSA-4vrf-ff7v-hpgr2021-05-21

  Division by zero in TFLite's implementation of `EmbeddingLookup`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, f61c57bd425878be108ec787f4d96390579fb83e

• GHSA-vf94-36g5-69v82021-05-21

  Division by zero in TFLite's implementation of `DepthToSpace`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 106d8f4fb89335a2c52d7c895b7a7485465ca8d9, 2.3.4, 2.4.3

• GHSA-3qgw-p4fm-x7gf2021-05-21

  Division by zero in TFLite's convolution code

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ff489d95a9006be080ad14feb378f2b4dac35552

• GHSA-cfx7-2xpc-8w4h2021-05-21

  Division by zero in TFLite's implementation of `BatchToSpaceNd`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 2c74674348a4708ced58ad6eb1b23354df8ee044

• GHSA-jjr8-m8g8-p6wv2021-05-21

  Null pointer dereference in TFLite's `Reshape` operator

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, f8378920345f4f4604202d4ab15ef64b2aceaa16

• GHSA-cwv3-863g-39vx2021-05-21

  Stack overflow due to looping TFLite subgraph

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 9c1dc920d8ffb4893d6c9d27d1f039607b326743, c6173f5fe66cdbab74f4f869311fe6aae2ba35f4

• GHSA-24x6-8c7m-hv3f2021-05-21

  Heap OOB read in TFLite's implementation of `Minimum` or `Maximum`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 953f28dca13c92839ba389c055587cfe6c723578

• GHSA-3w67-q784-6w7c2021-05-21

  Division by zero in TFLite's implementation of `GatherNd`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 8e45822aa0b9f5df4b4c64f221e64dc930a70a9d, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-vfr4-x8j2-3rf92021-05-21

  Division by zero in TFLite's implementation of `TransposeConv`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 801c1c6be5324219689c98e1bd3e0ca365ee834d

• GHSA-j7rm-8ww4-xx2g2021-05-21

  Division by zero in TFLite's implementation of `SpaceToDepth`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 0d45ea1ca641b21b73bcf9c00e0179cda284e7e7, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-26j7-6w8w-79222021-05-21

  Division by zero in optimized pooling implementations in TFLite

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 5f7975d09eac0f10ed8a17dbb6f5964977725adc

• GHSA-mv78-g7wq-mhp42021-05-21

  Division by zero in padding computation in TFLite

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 49847ae69a4e1a97ae7f2db5e217c77721e37948, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-xvjm-fvxx-q3hv2021-05-21

  CHECK-fail due to integer overflow

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 4c0ee937c0f61c4fc5f5d32d9bb4c67428012a60

• GHSA-9xh4-23q4-v6wr2021-05-21

  Heap buffer overflow and undefined behavior in `FusedBatchNorm`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 6972f9dfe325636b3db4e0bc517ee22a159365c0, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-c45w-2wxr-pp532021-05-21

  Heap OOB read in `tf.raw_ops.Dequantize`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 5899741d0421391ca878da47907b1452f06aaf1b

• GHSA-vq2r-5xvm-3hc32021-05-21

  Segfault in `CTCBeamSearchDecoder`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, b1b323042264740c398140da32e93fb9c2c9f33e

• GHSA-x8h6-xgqx-jqgp2021-05-21

  Undefined behavior and `CHECK`-fail in `FractionalMaxPoolGrad`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 32fdcbff9d06d010d908fcc4bd4b36eb3ce15925

• GHSA-79fv-9865-4qcv2021-05-21

  Heap buffer overflow in `MaxPoolGrad`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, a74768f8e4efbda4def9f16ee7e13cf3922ac5f7

• GHSA-6f89-8j54-29xf2021-05-21

  Heap buffer overflow in `FractionalAvgPoolGrad`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 12c727cee857fa19be717f336943d95fca4ffe4f

• GHSA-v6r6-84gr-92rm2021-05-21

  Heap buffer overflow in `AvgPool3DGrad`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 6fc9141f42f6a72180ecd24021c3e6b36165fe0d

• GHSA-7cqx-92hp-x6wh2021-05-21

  Heap buffer overflow in `MaxPool3DGradGrad`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 63c6a29d0f2d692b247f7bf81f8732d6442fad09

• GHSA-6qgm-fv6v-rfpv2021-05-21

  Overflow/denial of service in `tf.raw_ops.ReverseSequence`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ecf768cbe50cedc0a45ce1ee223146a3d3d26d23, 2.2.0rc0

• GHSA-828x-qc2p-wprq2021-05-21

  Undefined behavior in `MaxPool3DGradGrad`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, a3d9f9be9ac2296615644061b40cefcee341dcc4

• GHSA-9vpm-rcf4-9wqw2021-05-21

  Division by 0 in `MaxPoolGradWithArgmax`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 376c352a37ce5a68b721406dc7e77ac4b6cf483d

• GHSA-5gqf-456p-48362021-05-21

  Reference binding to nullptr in `SdcaOptimizer`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, f7cc8755ac6683131fdfa7a8a121f9d7a9dec6fb

• GHSA-whr9-vfh2-7hm62021-05-21

  Memory corruption in `DrawBoundingBoxesV2`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 79865b542f9ffdc9caeb255631f7c56f1d4b6517, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-545v-42p7-98fq2021-05-21

  Heap out of bounds read in `MaxPoolGradWithArgmax`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, dcd7867de0fea4b72a2b34bd41eb74548dc23886

• GHSA-3h8m-483j-7xxm2021-05-21

  Heap out of bounds read in `RequantizationRange`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ef0c008ee84bad91ec6725ddc42091e19a30cf0e

• GHSA-4p4p-www8-8fv92021-05-21

  Reference binding to null in `ParameterizedTruncatedNormal`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 5e52ef5a461570cfb68f3bdbbebfe972cb4e0fd8, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-wp3c-xw9g-gpcg2021-05-21

  Lack of validation in `SparseDenseCwiseMul`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 7ae2af34087fb4b5c8915279efd03da3b81028bc

• GHSA-pvrc-hg3f-58r62021-05-21

  Heap OOB access in `Dilation2DBackpropInput`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 3f6fe4dfef6f57e768260b48166c27d148f3015f, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-r6pg-pjwc-j5852021-05-21

  Null pointer dereference in `SparseFillEmptyRows`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, faa76f39014ed3b5e2c158593b1335522e573c7f

• GHSA-75f6-78jr-46562021-05-21

  Null pointer dereference in `EditDistance`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, f4c364a5d6880557f6f5b6eb5cee2c407f0186b3

• GHSA-ph87-fvjr-v33w2021-05-21

  CHECK-fail in `tf.raw_ops.RFFT`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 31bd5026304677faa8a0b77602c6154171b9aec1, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-36vm-xw34-x4pj2021-05-21

  CHECK-fail in `tf.raw_ops.IRFFT`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 1c56f53be0b722ca657cbc7df461ed676c8642a2

• GHSA-gvm4-h8j3-rjrq2021-05-21

  CHECK-fail in `LoadAndRemapMatrix`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 77dd114513d7796e1e2b8aece214a380af26fbf4

• GHSA-8gv3-57p6-g35r2021-05-21

  Heap buffer overflow in `RaggedTensorToTensor`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, a84358aa12f0b1518e606095ab9cfddbf597c121, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-59q2-x2qc-4c972021-05-21

  Heap OOB access in unicode ops

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 51300ba1cc2f487aefec6e6631fef03b0e08b298

• GHSA-mqh2-9wrp-vx842021-05-21

  Heap buffer overflow in `SparseSplit`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-xw93-v57j-fcgh2021-05-21

  Division by 0 in `SparseMatMul`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 7f283ff806b2031f407db64c4d3edcda8fb9f9f5

• GHSA-fxqh-cfjm-fp932021-05-21

  Division by 0 in `Reverse`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 4071d8e2f6c45c1955a811fee757ca2adbe462c1, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-r35g-4525-29fq2021-05-21

  Division by 0 in `FusedBatchNorm`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 1a2a87229d1d61e23a39373777c056161eb4084d

• GHSA-qg48-85hg-mqc52021-05-21

  Division by 0 in `DenseCountSparseOutput`

  Fixed in: 2.3.3, 2.4.2, da5ff2daf618591f64b2b62d9d9803951b945e9f, 2.1.4, 2.2.3

• GHSA-h9px-9vqg-222h2021-05-21

  Heap OOB in `QuantizeAndDequantizeV3`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 99085e8ff02c3763a0ec2263e44daec416f6a387

• GHSA-jhq9-wm9m-cf892021-05-21

  CHECK-failure in `UnsortedSegmentJoin`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 704866eabe03a9aeda044ec91a8d0c83fc1ebdbe, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-vqw6-72r7-fgw72021-05-21

  OOB read in `MatrixTriangularSolve`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 480641e3599775a8895254ffbc0fc45621334f68, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-f78g-q7r4-9wcv2021-05-21

  Division by 0 in `FractionalAvgPool`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 548b5eaf23685d86f722233d8fbc21d0a4aecb96, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-x83m-p7pv-ch8v2021-05-21

  Division by 0 in `QuantizedAdd`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 744009c9e5cc5d0447f0dc39d055f917e1fd9e16, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-p45v-v4pw-77jr2021-05-21

  Division by 0 in `QuantizedBatchNormWithGlobalNormalization`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, d6ed5bcfe1dcab9e85a4d39931bd18d99018e75b

• GHSA-4fg4-p75j-w5xj2021-05-21

  Heap out of bounds in `QuantizedBatchNormWithGlobalNormalization`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, d6ed5bcfe1dcab9e85a4d39931bd18d99018e75b, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-m34j-p8rj-wjxq2021-05-21

  Division by 0 in `QuantizedBiasAdd`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 67784700869470d65d5f2ef20aeb5e97c31673cb, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-hmg3-c7xj-6qwm2021-05-21

  Heap buffer overflow in `SparseTensorToCSRSparseMatrix`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 1e922ccdf6bf46a3a52641f99fd47d54c1decd13, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-6g85-3hm8-83f92021-05-21

  CHECK-fail in `QuantizeAndDequantizeV4Grad`

  Fixed in: 2.4.2, 20431e9044cf2ad3c0323c34888b192f3289af6b, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-fphq-gw9m-ghrv2021-05-21

  CHECK-fail in `CTCGreedyDecoder`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ea3b43e98c32c97b35d52b4c66f9107452ca8fb2, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-4hrh-9vmp-2jgg2021-05-21

  Heap buffer overflow in `StringNGrams`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ba424dd8f16f7110eea526a8086f1a155f14f22b

• GHSA-xqfj-35wv-m3cr2021-05-21

  Null pointer dereference in `StringNGrams`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ba424dd8f16f7110eea526a8086f1a155f14f22b

• GHSA-xgc3-m89p-vr3x2021-05-21

  Heap buffer overflow in `Conv2DBackpropFilter`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, c570e2ecfc822941335ad48f6e10df4e21f11c96, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-g4h2-gqm3-c9wq2021-05-21

  Segfault in tf.raw_ops.ImmutableConst

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 4f663d4b8f0bec1b48da6fa091a7d29609980fa4, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-j8qc-5fqr-52fp2021-05-21

  Division by zero in `Conv2DBackpropFilter`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, c570e2ecfc822941335ad48f6e10df4e21f11c96, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-8c89-2vwr-chcq2021-05-21

  Heap buffer overflow in `QuantizedResizeBilinear`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, f6c40f0c6cbf00d46c7717a26419f2062f2f8694, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-2gfx-95x2-5v3x2021-05-21

  Heap buffer overflow in `QuantizedReshape`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, a324ac84e573fba362a5e53d4e74d5de6729933e, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-m3f9-w3p3-p6692021-05-21

  Heap buffer overflow in `QuantizedMul`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, efea03b38fb8d3b81762237dc85e579cc5fc6e87, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-6j9c-grc6-5m6g2021-05-21

  CHECK-fail in SparseConcat

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 69c68ecbb24dff3fa0e46da0d16c821a2dd22d7c, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-393f-2jr3-cp692021-05-21

  CHECK-fail in DrawBoundingBoxes

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, b432a38fe0e1b4b904a6c222cbce794c39703e87, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-j47f-4232-hvv82021-05-21

  Heap out of bounds read in `RaggedCross`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 44b7f486c0143f68b56c34e2d01e146ee445134a, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-3qxp-qjq7-w4hf2021-05-21

  CHECK-fail in tf.raw_ops.EncodePng

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 26eb323554ffccd173e8a79a8c05c15b685ae4d1

• GHSA-xcwj-wfcm-m23c2021-05-21

  Invalid validation in `SparseMatrixSparseCholesky`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, e6a7c7cc18c3aaad1ae0872cb0a959f5c923d2bd

• GHSA-jfp7-4j67-8r3q2021-05-21

  Heap buffer overflow caused by rounding

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, f851613f8f0fb0c838d160ced13c134f778e3ce7

• GHSA-6f84-42vf-ppwp2021-05-21

  Division by 0 in `QuantizedMul`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, a1b11d2fdd1e51bfe18bb1ede804f60abfa92da6

• GHSA-x4g7-fvjj-prg82021-05-21

  Division by 0 in `QuantizedConv2D`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, cfa91be9863a91d5105a3b4941096044ab32036b

• GHSA-4vf2-4xcg-65cx2021-05-21

  Division by 0 in `Conv2D`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, b12aa1d44352de21d1a6faaf04172d8c2508b42b

• GHSA-xm2v-8rrw-w9pm2021-05-21

  Division by 0 in `Conv2DBackpropInput`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 2be2cdf3a123e231b16f766aa0e27d56b4606535

• GHSA-r4pj-74mg-88682021-05-21

  Division by 0 in `Conv2DBackpropFilter`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, fca9874a9b42a2134f907d2fb46ab774a831404a

• GHSA-2cpx-427x-q2c62021-05-21

  CHECK-fail in AddManySparseToTensorsMap

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 69c68ecbb24dff3fa0e46da0d16c821a2dd22d7c

• GHSA-c968-pq7h-7fxv2021-05-21

  Division by 0 in `Conv3DBackprop*`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 311403edbc9816df80274bd1ea8b3c0c0f22c3fa

• GHSA-hr84-fqvp-48mm2021-05-21

  Segfault in SparseCountSparseOutput

  Fixed in: 2.3.3, 2.4.2, c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5

• GHSA-wcv5-qrj6-9pfm2021-05-21

  Heap buffer overflow in `Conv3DBackprop*`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 8f37b52e1320d8d72a9529b2468277791a261197

• GHSA-772j-h9xw-ffp52021-05-21

  CHECK-fail in SparseCross due to type confusion

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025

• GHSA-62gx-355r-9fhg2021-05-21

  Session operations in eager mode lead to null pointer dereferences

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, ff70c47a396ef1e3cb73c90513da4f5cb71bebba

• GHSA-772p-x54p-hjrv2021-05-21

  Division by zero in `Conv3D`

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 799f835a3dfa00a4d852defa29b15841eea9d64f

• GHSA-84mw-34w6-2q432021-05-21

  Null pointer dereference via invalid Ragged Tensors

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, b055b9c474cd376259dde8779908f9eeaf097d93

• GHSA-hc6c-75p4-hmq42021-05-21

  Reference binding to null pointer in `MatrixDiag*` ops

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, a7116dd3913c4a4afd2a3a938573aa7c785fdfc6

• GHSA-8h46-5m9h-75532021-05-21

  Heap out of bounds write in `RaggedBinCount`

  Fixed in: 2.3.3, 2.4.2, eebb96c2830d48597d055d247c0e9aebaea94cd5, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-452g-f7fp-9jf72021-05-21

  Type confusion during tensor casts lead to dereferencing null pointers

  Fixed in: 2.1.4, 2.2.3, 2.3.3, 2.4.2, 030af767d357d1b4088c4a25c72cb3906abac489, 2.2.0rc0, 2.3.0rc0, 2.3.4, 2.4.3

• GHSA-4278-2v5v-65r42021-05-21

  Heap buffer overflow in `RaggedBinCount`

  Fixed in: 2.3.3, 2.4.2, eebb96c2830d48597d055d247c0e9aebaea94cd5

• GHSA-q263-fvxm-m5mw2020-12-10

  Heap out of bounds access in MakeEdge in TensorFlow

  Fixed in: 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, 0cc38aaa4064fd9e79101994ce9872c6d91f816b

• GHSA-m648-33qf-v3gp2020-12-10

  CHECK-fail in LSTM with zero-length input in TensorFlow

  Fixed in: 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, 14755416e364f17fb1870882fa778c7fec7f16e3

• GHSA-hhvc-g5hv-48c62020-12-10

  Write to immutable memory region in TensorFlow

  Fixed in: 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, c1e1fc899ad5f8c725dcbb6470069890b5060bc7

• GHSA-c9f3-9wfr-wgh72020-12-10

  Lack of validation in data format attributes in TensorFlow

  Fixed in: 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, ebc70b7a592420d3d2f359e4b1694c236b82c7ae

• GHSA-qhxx-j73r-qpm22020-12-10

  Uninitialized memory access in TensorFlow

  Fixed in: 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2

• GHSA-xwhf-g6j5-j5gc2020-11-13

  Float cast overflow undefined behavior

  Fixed in: 2.4.0

• GHSA-rrfp-j2mp-hq9c2020-11-13

  Segfault in `tf.quantization.quantize_and_dequantize`

  Fixed in: 2.4.0, eccb7ec454e6617738554a255d77f08e60ee0808

• GHSA-hx2x-85gr-wrpq2020-09-25

  Out of bounds access in tensorflow-lite

  Fixed in: 2.2.1, 2.3.1, 204945b19e44b57906c9344c0d00120eeeae178a

• GHSA-p2cq-cprg-frvm2020-09-25

  Out of bounds write in tensorflow-lite

  Fixed in: 2.2.1, 2.3.1, 204945b19e44b57906c9344c0d00120eeeae178a

• GHSA-hjmq-236j-8m872020-09-25

  Denial of service in tensorflow-lite

  Fixed in: 2.2.1, 2.3.1, 204945b19e44b57906c9344c0d00120eeeae178a

• GHSA-x9j7-x98r-r4w22020-09-25

  Segmentation fault in tensorflow-lite

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, d58c96946b2880991d63d1dacacb32f0a4dfa453

• GHSA-cvpc-8phh-8f452020-09-25

  Out of bounds access in tensorflow-lite

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, e11f55585f614645b360563072ffeb5c3eeff162, cd31fd0ce0449a9e0f83dcad08d6ed7f1d6bef3f, 46d5b0852528ddfd614ded79bccc75589f801bd9, 00302787b788c5ff04cb6f62aed5a74d936e86c0, fff2c8326280c07733828f990548979bdc893859, 1970c2158b1ffa416d159d03c3370b9a462aee35

• GHSA-qh32-6jjc-qprm2020-09-25

  Null pointer dereference in tensorflow-lite

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 0b5662bc2be13a8c8f044d925d87fb6e56247cd8

• GHSA-mxjj-953w-2c2v2020-09-25

  Data corruption in tensorflow-lite

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 8ee24e7949a203d234489f9da2c5bf45a7d5157d

• GHSA-q4qf-3fc6-8x342020-09-25

  Segfault and data corruption in tensorflow-lite

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 2d88f470dea2671b430884260f3626b1fe99830a

• GHSA-q8gv-q7wr-9jf82020-09-25

  Segfault in Tensorflow

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1

• GHSA-w5gh-2wr2-pm6g2020-09-25

  Denial of Service in Tensorflow

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, adf095206f25471e864a8e63a0f1caef53a0e3a6

• GHSA-g7p5-5759-qv462020-09-25

  Data leak in Tensorflow

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 0462de5b544ed4731aa2fb23946ac22c01856b80

• GHSA-xmq7-7fxm-rr792020-09-25

  Denial of Service in Tensorflow

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 33be22c65d86256e6826666662e40dbdfe70ee83

• GHSA-h6fg-mjxg-hqq42020-09-25

  Integer truncation in Shard API usage

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 27b417360cbd671ef55915e4bb6bb06af8b8a832, ca8c013b5e97b1373b3bb1c97ea655e69f31a575

• GHSA-p5f8-gfw5-33w42020-09-25

  Heap buffer overflow in Tensorflow

  Fixed in: 2.3.1, 3cbb917b4714766030b28eba9fb41bb97ce9ee02

• GHSA-x7rp-74x2-mjf32020-09-25

  Segfault in Tensorflow

  Fixed in: 2.3.1, 3cbb917b4714766030b28eba9fb41bb97ce9ee02

• GHSA-qc53-44cj-vfvx2020-09-25

  Denial of Service in Tensorflow

  Fixed in: 2.3.1, 3cbb917b4714766030b28eba9fb41bb97ce9ee02

• GHSA-63xm-rx5p-xvqr2020-09-25

  Heap buffer overflow in Tensorflow

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 390611e0d45c5793c7066110af37c8514e6a6c54

• GHSA-rjjg-hgv6-h69v2020-09-25

  Memory corruption in Tensorflow

  Fixed in: 2.2.1, 2.3.1, 22e07fb204386768e5bcbea563641ea11f96ceb8

• GHSA-q8qj-fc9q-cphr2020-09-25

  Undefined behavior in Tensorflow

  Fixed in: 2.2.1, 2.3.1, 22e07fb204386768e5bcbea563641ea11f96ceb8

• GHSA-x5cp-9pcf-pp3h2020-09-25

  Denial of Service in Tensorflow

  Fixed in: 2.3.1, 3cbb917b4714766030b28eba9fb41bb97ce9ee02

• GHSA-jc87-6vpp-7ff32020-09-25

  Heap buffer overflow in Tensorflow

  Fixed in: 2.3.1, 3cbb917b4714766030b28eba9fb41bb97ce9ee02

• GHSA-pg59-2f92-5cph2020-09-25

  Heap buffer overflow in Tensorflow

  Fixed in: 2.3.1, 3cbb917b4714766030b28eba9fb41bb97ce9ee02

• GHSA-9mqp-7v2h-23822020-09-25

  Denial of Service in Tensorflow

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, 390611e0d45c5793c7066110af37c8514e6a6c54

• GHSA-8fxw-76px-3rxv2020-09-25

  Memory leak in Tensorflow

  Fixed in: 2.2.1, 2.3.1, 22e07fb204386768e5bcbea563641ea11f96ceb8

• GHSA-4g9f-63rx-5cw42020-09-25

  Segfault in Tensorflow

  Fixed in: 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1, da8558533d925694483d2c136a9220d6d49d843c

• PYSEC-2020-2692020-05-04

  TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.

  Fixed in: 49f73c55d56edffebde4bca4a407ad69c1cae433, 1.7.0

• GHSA-977j-xj7q-2jr92020-01-28

  Segmentation faultin TensorFlow when converting a Python string to `tf.float16`

  Fixed in: 1.15.2, 2.0.1, 5ac1b9e24ff6afc465756edf845d2e9660bd34bf

• GHSA-844w-j86r-4x2j2019-12-16

  Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow

  Fixed in: 1.15.0, db4f9717c41bccc3ce10099ab61996b246099892

• PYSEC-2019-2232019-04-24

  Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.

  Fixed in: 1.7.1

• PYSEC-2019-2222019-04-24

  Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.

  Fixed in: 1.7.1

• PYSEC-2019-2252019-04-24

  Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.

  Fixed in: 1.7.1

• PYSEC-2019-2282019-04-24

  NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.

  Fixed in: 1.12.2

• PYSEC-2019-2242019-04-23

  Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

  Fixed in: 1.7.0rc0

• PYSEC-2019-2262019-04-23

  Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).

  Fixed in: 1.7.1