{"data":{"id":"5f488bf0-cea9-4215-a7f0-7e77d32d6786","title":"CVE-2021-29535: TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `","summary":"TensorFlow, an open-source machine learning platform, has a vulnerability (CVE-2021-29535) where attackers can cause a heap buffer overflow (a memory safety error where code writes beyond allocated memory) in the `QuantizedMul` function by providing invalid threshold values for quantization. The bug occurs because the code assumes input values are always valid and tries to access data that doesn't exist when empty tensors (multi-dimensional arrays) are passed in.","solution":"The fix will be included in TensorFlow 2.5.0. The patch will also be backported to TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-29535","publishedAt":"2021-05-15T00:15:12.210Z","cveId":"CVE-2021-29535","cweIds":["CWE-131","CWE-787"],"cvssScore":"2.5","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00018,"patchAvailable":null,"disclosureDate":null,"capecIds":["CAPEC-100"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}