CVE-2023-25676
TensorFlow has null dereference on ParallelConcat with XLA
Résumé
TensorFlow has null dereference on ParallelConcat with XLA
Description d'origine
La description telle que publiée par la source (souvent en anglais).
TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
PyPI
tensorflow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1"}]}]
PyPI
tensorflow-cpu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1"}]}]
PyPI
tensorflow-gpu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1"}]}]
Bitnami
tensorflow
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.12.0"}]}]
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com