GitHub Advisoryadvisory · PyPI

GHSA-h98h-8mxr-m8gx Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.

HIGH Published 2020-05-13 Modified 2024-10-28 Official page ↗
Aliases
CVE-2018-21233
Ecosystem
PyPI
Packages
tensorflow, tensorflow-gpu
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-125
Reviewed
2020-05-13

Affected packages

• PyPI tensorflow: < 1.7.0 → fixed in 1.7.0 • PyPI tensorflow-gpu: < 1.7.0 → fixed in 1.7.0

Description

TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in `core/kernels/decode_bmp_op.cc`.

Related

Alias · CVE (1)

  • CVE-2018-21233 TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process… vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References