AI Sec Watch

Google TensorFlow version 1.7.x and earlier contains a buffer overflow vulnerability (a bug where a program writes data outside its intended memory boundaries), which can be exploited in ways that depend on the specific context in which TensorFlow is used. The vulnerability is related to integer overflow or wraparound issues (errors in how very large numbers are handled in calculations).

A NULL pointer dereference (a type of bug where software tries to access memory that doesn't exist) in Google TensorFlow versions before 1.12.2 could allow an attacker to cause a denial of service (making the software crash or become unresponsive) by providing an invalid GIF image file. This vulnerability affects TensorFlow's image processing capabilities.

A bug in Google's Snappy library version 1.1.4, used in TensorFlow before version 1.7.1, allows a memcpy operation (a function that copies data in memory) to overlap with itself, potentially causing the program to crash or expose data from other parts of the computer's memory. This vulnerability stems from improper input validation (checking whether user input is safe before processing it).

CVE-2018-10055 is a vulnerability in TensorFlow (a machine learning framework) versions before 1.7.1 where the XLA compiler (a tool that optimizes machine learning code) has a memory access bug that could crash the program or allow reading data from other parts of the computer's memory when processing a specially crafted configuration file.

Google TensorFlow version 1.7 and below contains a buffer overflow (a bug where a program writes data beyond the memory space it's supposed to use), which allows an attacker to execute arbitrary code locally on the affected system. This vulnerability is tracked as CVE-2018-8825 and was identified as a weakness in how the software restricts operations within memory boundaries.

Google TensorFlow version 1.6.x and earlier contains a null pointer dereference vulnerability (a type of bug where software tries to access memory that doesn't exist, causing it to crash or behave unexpectedly). The vulnerability's impact depends on the specific context in which TensorFlow is being used.

CVE-2019-10844 is a vulnerability in Sony Neural Network Libraries (nnabla) through version v1.0.14 where the logger component relies on the HOME environment variable (a system setting that tells programs where a user's personal files are stored), which may be untrusted and could potentially be exploited. The vulnerability affects the libnnabla.a library file used in the software.

Elasticsearch Security versions 6.5.0 and 6.5.1 have an XXE flaw (XML external entity injection, where an attacker exploits how the software processes XML data) in the Machine Learning find_file_structure API. If Elasticsearch's Java Security Manager allows external network access, an attacker could send a crafted request to leak local files from the server, potentially exposing sensitive information.

Square's Retrofit library (a tool for making web requests in Java) contained an XXE vulnerability (XML External Entity attack, where an attacker tricks the system into reading files by embedding malicious instructions in XML data) in its JAXB component. An attacker could exploit this to read files from the system or perform SSRF (server-side request forgery, where an attacker makes the server send requests to unintended targets).