Impact
If Requantize is given input_min, input_max, requested_output_min, requested_output_max tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack.
import tensorflow as tf
out_type = tf.quint8
inp…
Withdrawn Advisory
This advisory has been withdrawn because it does not discuss a particular vulnerability in the code of ansi_term.
Original Description
The maintainer has adviced this crate is deprecated and will not receive any maintenance.
The crat…
Impact
The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor:
import tensorflow as tf
tf.reshape(tensor=[[1]],shape=tf.cons…
Impact
The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by assuming input(0), input(1), and input(2) to be scalar.
import tensorflow as tf
tf.raw_ops.SobolSample(dim=tf.constant([1,0]…
Impact
If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack.
import tensorflow as tf
tf.sparse.cross(inputs=[],name=’a’,separator=tf.constant([‘a’, ‘b’],dtype…
Impact
When Conv2DBackpropInput receives empty out_backprop inputs (e.g. [3, 1, 0, 1]), the current CPU/GPU kernels CHECK fail (one with dnnl, the other with cudnn). This can be used to trigger a denial of service attack.
import tensorflow as tf
import…
Issue
If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf clients < 0.3.2 are susceptible to an attack where attacke…
The Rust Security Response WG was notified that Cargo did not prevent extracting some malformed packages downloaded from alternate registries. An attacker able to upload packages to an alternate registry could corrupt arbitary files when Cargo download…
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the input variable in main.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-37260
https://github.com/stealjs/steal/issues/1529
https://github.com/stealjs/steal/…
Impact
The function _verify_root_self_signed(), introduced in v0.14.0, and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could the…
