https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:16:24 +0000 https://cve.radiocsirt.org/vuln/bit-tensorflow-2020-15203 <p><strong>Affected:</strong> Bitnami: tensorflow</p> <p>In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.</p> <p><strong>Affected:</strong> Bitnami: tensorflow</p> <p>In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.</p> https://cve.radiocsirt.org/vuln/bit-tensorflow-2020-15203 https://cve.radiocsirt.org/vuln/cnvd-2020-54472 cnvd-2020-54472 https://cve.radiocsirt.org/vuln/cnvd-2020-54472 https://cve.radiocsirt.org/vuln/euvd-2026-42773 EUVD-2026-42773 https://cve.radiocsirt.org/vuln/euvd-2026-42773 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15203 <p>In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.</p> <p>In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-15203 https://cve.radiocsirt.org/vuln/ghsa-xmq7-7fxm-rr79 <p><strong>Affected:</strong> PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu</p> <p>### Impact By controlling the `fill` argument of [`tf.strings.as_string`](https://www.tensorflow.org/api_docs/python/tf/strings/as_string), a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/as_string_op.cc#L68-L74</p> <p>This can result in unexpected output: ```python In [1]: tf.strings.as_string(input=[1234], width=6, fill=&#39;-&#39;) Out[1]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39;1234 &#39;], dtype=object)&gt; In [2]: tf.strings.as_string(input=[1234], width=6, fill=&#39;+&#39;) Out[2]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39; +1234&#39;], dtype=object)&gt; In [3]: tf.strings.as_string(input=[1234], width=6, fill=&#34;h&#34;) Out[3]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39;%6d&#39;], dtype=object)&gt; In [4]: tf.strings.as_string(input=[1234], width=6, fill=&#34;d&#34;) Out[4]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39;12346d&#39;], dtype=object)&gt; In [5]: tf.strings.as_string(input=[1234], width=6, fill=&#34;o&#34;) Out[5]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([…</p> <p><strong>Affected:</strong> PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu</p> <p>### Impact By controlling the `fill` argument of [`tf.strings.as_string`](https://www.tensorflow.org/api_docs/python/tf/strings/as_string), a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/as_string_op.cc#L68-L74</p> <p>This can result in unexpected output: ```python In [1]: tf.strings.as_string(input=[1234], width=6, fill=&#39;-&#39;) Out[1]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39;1234 &#39;], dtype=object)&gt; In [2]: tf.strings.as_string(input=[1234], width=6, fill=&#39;+&#39;) Out[2]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39; +1234&#39;], dtype=object)&gt; In [3]: tf.strings.as_string(input=[1234], width=6, fill=&#34;h&#34;) Out[3]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39;%6d&#39;], dtype=object)&gt; In [4]: tf.strings.as_string(input=[1234], width=6, fill=&#34;d&#34;) Out[4]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([&#39;12346d&#39;], dtype=object)&gt; In [5]: tf.strings.as_string(input=[1234], width=6, fill=&#34;o&#34;) Out[5]: &lt;tf.Tensor: shape=(1,), dtype=string, numpy=array([…</p> https://cve.radiocsirt.org/vuln/ghsa-xmq7-7fxm-rr79 https://cve.radiocsirt.org/vuln/gsd-2020-15203 gsd-2020-15203 https://cve.radiocsirt.org/vuln/gsd-2020-15203 https://cve.radiocsirt.org/vuln/opensuse-su-2020:1766-1 <p>Security update for tensorflow2</p> <p>Security update for tensorflow2</p> https://cve.radiocsirt.org/vuln/opensuse-su-2020:1766-1 https://cve.radiocsirt.org/vuln/pysec-2020-126 <p><strong>Affected:</strong> PyPI: tensorflow</p> <p>In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.</p> <p><strong>Affected:</strong> PyPI: tensorflow</p> <p>In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.</p> https://cve.radiocsirt.org/vuln/pysec-2020-126