CVE-2021-29537 log
Source |
|
Severity | Low |
Remote | No |
Type | Arbitrary code execution |
Description | A security issue has been found in TensorFlow before version 2.4.2. An attacker can cause a heap buffer overflow in `QuantizedResizeBilinear` by passing in invalid thresholds for the quantization. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/50711818d2e61ccce012591eeb4fdf93a8496726/tensorflow/core/kernels/quantized_resize_bilinear_op.cc#L705-L706) assumes that the 2 arguments are always valid scalars and tries to access the numeric value directly. |
Group | Package | Affected | Fixed | Severity | Status | Ticket |
---|---|---|---|---|---|---|
AVG-1962 | tensorflow | 2.4.1-10 | 2.5.0-1 | Critical | Fixed |
References |
---|
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8c89-2vwr-chcq https://github.com/tensorflow/tensorflow/commit/f6c40f0c6cbf00d46c7717a26419f2062f2f8694 |