Browse All

TensorFlow, an open source machine learning framework, has a vulnerability in its `SparseCountSparseOutput` function where an integer overflow (a number becoming too large for its storage space) can crash the TensorFlow process during memory allocation. This vulnerability affects multiple versions of TensorFlow.

TensorFlow (an open-source machine learning framework) has a vulnerability in its Bincount operations that allows attackers to crash the system (denial of service) by sending specially crafted arguments that trigger internal safety checks to fail. The problem occurs because some invalid input conditions aren't caught early enough during the system's processing stages, leading to crashes when the system tries to allocate memory for output data.

TensorFlow (an open-source machine learning framework) has a vulnerability where certain operations can crash the program through denial of service attacks (making it unavailable by triggering assertion failures, which are safety checks in code that stop execution if something goes wrong). The developers have fixed the issue and plan to release patches across multiple supported versions.

TensorFlow, an open-source machine learning framework, has a vulnerability in its `FractionalMaxPool` function (a pooling operation used in neural networks) that can crash the program through a division by zero error (attempting to divide a number by zero, which is mathematically undefined). The vulnerability affects multiple versions of TensorFlow.

TensorFlow, an open-source machine learning framework, has a vulnerability in its `MapStage` component where a CHECK-fail (a type of crash caused by a failed validation check) occurs if the key tensor (a multi-dimensional array of data) is not a scalar (a single value). This bug can cause the program to crash unexpectedly.

TensorFlow, an open-source machine learning framework, has a vulnerability in its `UnravelIndex` function caused by an integer overflow bug (a situation where a number becomes too large for the system to handle correctly) that leads to division by zero. This flaw affects multiple versions of TensorFlow and could allow attackers to crash or disrupt the software.

TensorFlow (an open-source machine learning framework) has a bug where a cost estimator for convolution operations can be forced to divide by zero because it doesn't check that the stride argument (a parameter controlling step size in operations) is positive. The fix adds validation to ensure the stride is valid before the operation runs.

TensorFlow (an open-source machine learning framework) has a vulnerability in the `AddManySparseToTensorsMap` function where an integer overflow (when a number gets too large for its storage space) causes the program to crash when creating new TensorShape objects. The problem exists because the code doesn't properly validate input tensor shapes before using them.

TensorFlow, an open-source machine learning framework, has a vulnerability in its `Sparse*Cwise*` operations (specialized math functions for sparse tensors, a type of data structure with mostly empty values) that can be exploited through integer overflows (when calculations produce numbers too large for the system to handle). An attacker could cause the system to run out of memory or crash by providing specially crafted input dimensions.

A bug in TensorFlow's `StringNGrams` function (a tool that breaks text into small overlapping pieces) allows attackers to crash the system by causing it to run out of memory through an integer overflow (when a number gets too large and wraps around to an incorrect value). The problem stems from missing validation on the `pad_width` parameter, which can result in a negative `ngram_width` value that causes excessive memory allocation.

TensorFlow (an open source machine learning framework) has a vulnerability in its `ThreadPoolHandle` component that allows attackers to cause a denial of service attack (making a service unavailable by overwhelming it) by allocating excessive memory. The problem exists because the code only checks that the `num_threads` argument is not negative, but does not limit how large the value can be.

TensorFlow, an open-source machine learning framework, has a bug in its shape inference (the process of figuring out data dimensions) for the `ConcatV2` operation that can be exploited to crash a program through a segfault (a memory access error). The vulnerability occurs because a type confusion (mixing up different data types) allows a negative value to bypass a safety check, potentially letting attackers cause a denial of service attack (making the system unavailable).

IBM WebSphere Application Server Liberty versions 21.0.0.10 through 21.0.0.12 have a security weakness that allows remote attackers (attackers from outside the system) to obtain sensitive information and gain unauthorized access to JAX-WS applications (a type of web service technology). The vulnerability received an IBM security ID of 217224 but has not yet been assigned a CVSS score (a standard 0-10 rating of how severe a vulnerability is).

A vulnerability (CVE-2022-21299) exists in Oracle Java SE and Oracle GraalVM Enterprise Edition in the JAXP component (a Java library for processing XML), affecting versions like Java 8u311 and 11.0.13. An attacker without authentication can exploit this over the network to partially disrupt (denial of service) the affected Java applications, especially those running untrusted code from the internet.

A vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition's JAXP component (a Java library for processing XML data) allows an attacker on the network to read some data they shouldn't have access to without needing to log in. The vulnerability affects several older versions of Java and can be exploited through web services or untrusted code running in a Java sandbox (a restricted environment meant to safely run untrusted programs).