GitHub Advisoryadvisory · PyPI

GHSA-fqm2-gh8w-gr68 TensorFlow vulnerable to segfault when opening multiframe gif

MEDIUM Published 2023-03-24 Modified 2023-03-27 Official page ↗
Aliases
CVE-2023-25667
Ecosystem
PyPI
Packages
tensorflow, tensorflow-cpu, tensorflow-gpu
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-190
Reviewed
2023-03-24

Affected packages

• PyPI tensorflow: < 2.11.1 → fixed in 2.11.1 • PyPI tensorflow-cpu: < 2.11.1 → fixed in 2.11.1 • PyPI tensorflow-gpu: < 2.11.1 → fixed in 2.11.1

Description

Impact Integer overflow occurs when 2^31 <= num_frames * height * width * channels < 2^32, for example Full HD screencast of at least 346 frames. ```python import urllib.request dat = urllib.request.urlopen('https://raw.githubusercontent.com/tensorflow/tensorflow/1c38ad9b78ffe06076745a1ee00cec42f39ff726/tensorflow/core/lib/gif/testdata/3g_multiframe.gif').read() import tensorflow as tf tf.io.decode_gif(dat) ``` Patches We have patched the issue in GitHub commit 8dc723fcdd1a6127d6c970bd2ecb18b019a1a58d. The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1 For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by Andrei

Related

Alias · CVE (1)

  • CVE-2023-25667 TensorFlow is an open source platform for machine learning. vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References