Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-37670Heap OOB in `UpperBound` and `LowerBound` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37691Division by zero in LSH in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37679Heap OOB in nested `tf.map_fn` with `RaggedTensor`s in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37672Heap OOB in `SdcaOptimizerV2` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37687Heap OOB in TensorFlow Lite's `Gather*` implementationsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37685Heap OOB in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37681Null pointer exception in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37689Null pointer dereference in TensorFlow Lite MLIR optimizationsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37688Null pointer dereference in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37686Infinite loop in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.0rc2, 2.3.4, 2.4.3
- CVE-2021-37680Division by zero in TFLite in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37675Division by 0 in most convolution operators in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37676Reference binding to nullptr in shape inference in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37671Reference binding to nullptr in map operations in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37666Reference binding to nullptr in `RaggedTensorToVariant` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37667Reference binding to nullptr in unicode encoding in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37648Incorrect validation of `SaveV2` inputs in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37652Use after free in boosted trees creation in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37646Bad alloc in `StringNGrams` caused by integer conversion in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37661Crash caused by integer conversion to unsigned in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37645Integer overflow due to conversion to unsigned in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.3, 2.5.1, 2.3.4
- CVE-2021-37651Heap buffer overflow in `FractionalAvgPoolGrad` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37650Segfault and heap buffer overflow in `{Experimental,}DatasetToTFRecord` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37662Reference binding to nullptr in boosted trees in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37656Reference binding to nullptr in `RaggedTensorToSparse` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37657Reference binding to nullptr in `MatrixDiagV*` ops in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37658Reference binding to nullptr in `MatrixSetDiagV*` ops in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37644`std::abort` raised from `TensorListReserve` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37654Heap OOB and CHECK fail in `ResourceGather` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37641Heap OOB in `RaggedGather` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1