AI & LLM Vulnerabilities

CVE-2022-29206 is a bug in TensorFlow (an open source machine learning platform) where a specific function called `tf.raw_ops.SparseTensorDenseAdd` doesn't properly check its input arguments, causing a nullptr (a reference pointing to nothing) to be accessed during execution, which leads to undefined behavior. This vulnerability affects TensorFlow versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

TensorFlow (an open-source machine learning platform) has a bug in older versions where calling certain compatibility functions with unsupported data types causes the program to crash. When the code tries to process a missing function, it attempts to use a null pointer (a reference to nothing in memory), which causes a segmentation fault (a type of crash where the program accesses memory it shouldn't).

TensorFlow, an open source platform for machine learning, has a vulnerability in one of its operations called `tf.raw_ops.UnsortedSegmentJoin` where it doesn't properly check its inputs before using them. If someone provides a negative number where a positive one is expected, it causes the program to crash with an assertion failure, which is a type of denial of service attack (making software unavailable by crashing it).

CVE-2022-29203 is a vulnerability in TensorFlow (an open source platform for machine learning) where a function called `tf.raw_ops.SpaceToBatchND` has an integer overflow bug (a situation where a calculation produces a number too large for the system to handle). This overflow causes a denial of service (making the system crash or become unavailable) when the buggy code tries to allocate memory for output data.

A vulnerability in TensorFlow (an open source platform for machine learning) versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 allows attackers to cause a denial of service (making a system unavailable by consuming all available memory) by exploiting the `tf.ragged.constant` function, which does not properly check its input arguments. The vulnerability exists because of improper input validation (checking that data meets expected requirements before using it).

TensorFlow, an open source machine learning platform, had a vulnerability in its `tf.raw_ops.QuantizedConv2D` function (a tool for processing images with reduced precision) before versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 where it did not properly check input arguments, causing references to point to nullptr (an invalid memory location). This flaw was fixed in the mentioned versions.

TensorFlow (an open source platform for machine learning) has a vulnerability in versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4 where certain operations fail when given an invalid resource handle (a reference to data or tools the program needs). In eager mode (where TensorFlow executes code immediately rather than preparing a plan first), this can cause a reference to point to a null pointer (a memory location that doesn't exist), leading to undefined behavior and potential crashes or errors. Graph mode had safeguards that prevented this issue.

TensorFlow (an open-source machine learning platform) has a bug in the `tf.raw_ops.LSTMBlockCell` function where it doesn't properly check that input arguments have the correct structure. An attacker can exploit this to cause a denial of service attack (crashing the program), because the code fails when trying to access elements inside incorrectly-shaped inputs.

TensorFlow (an open source machine learning platform) had a bug in the `tf.raw_ops.LoadAndRemapMatrix` function that didn't properly check its input arguments, specifically whether the `initializing_values` parameter was valid. This missing validation could cause the program to crash (denial of service, a type of attack that makes a service unavailable), even though the attacker doesn't gain control of the system.

TensorFlow, an open source machine learning platform, has a vulnerability in a function called `tf.raw_ops.SparseTensorToCSRSparseMatrix` that doesn't properly check its inputs before processing them. This missing validation allows attackers to cause a denial of service attack (making the system crash or become unavailable) by sending specially crafted data that violates the expected format for sparse tensors (data structures that store mostly empty values efficiently).

A bug in TensorFlow (an open source machine learning platform) versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4 fails to validate input arguments to the `tf.raw_ops.UnsortedSegmentJoin` function, allowing attackers to trigger a denial of service attack (making the system crash or become unavailable). The vulnerability stems from the code assuming `num_segments` is a scalar (a single value) without checking this assumption first.

TensorFlow, an open source machine learning platform, has a vulnerability in its `tf.raw_ops.Conv3DBackpropFilterV2` function (a tool for training neural networks) that fails to properly check its input arguments before processing them. This missing validation allows attackers to crash the program with a denial of service attack (making it unavailable to legitimate users).

TensorFlow (an open source platform for machine learning) versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4 have a bug in the `tf.raw_ops.StagePeek` function that fails to check whether the `index` input is a scalar (a single number), allowing attackers to crash the system. This is a denial of service attack (making a service unavailable by overwhelming or breaking it).

TensorFlow, an open source platform for machine learning, had a vulnerability in the `tf.raw_ops.TensorSummaryV2` function that failed to properly validate (check the correctness of) input arguments before using them. This flaw could be exploited to cause a denial of service attack (making the system crash or become unavailable) by triggering a CHECK-failure (a forced program halt when an expected condition is not met).

TensorFlow, an open source machine learning platform, had a vulnerability in its `tf.raw_ops.DeleteSessionTensor` function (a specific operation within TensorFlow) that failed to properly check its input arguments before using them. This flaw could be exploited to cause a denial of service attack (making a system crash or become unavailable by sending specially crafted requests).

TensorFlow, an open source machine learning platform, had a vulnerability in the `tf.raw_ops.QuantizeAndDequantizeV4Grad` function where it did not fully validate input arguments before processing them. This bug could crash the system (a denial of service attack, where an attacker makes a service unavailable) in versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

TensorFlow, an open source machine learning platform, had a vulnerability in its `tf.raw_ops.GetSessionTensor` function (a command for retrieving tensor data from a session) where it did not properly validate input arguments, allowing attackers to crash the system through a denial of service attack (making software unavailable by overwhelming or breaking it). The vulnerability was fixed in TensorFlow versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

A vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition (a high-performance Java runtime) in the JAXP component (Java API for XML Processing, which handles XML data) allows an unauthenticated attacker to partially disable these systems over a network. The vulnerability affects specific versions of Java and can be exploited through untrusted code in web applications or through web services that supply data to the vulnerable APIs, with a severity rating of 5.3 out of 10.