https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:47:47 +0000 https://cve.radiocsirt.org/vuln/cve-2020-26267 <p><strong>Affected:</strong> tensorflow</p> <p>In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.</p> <p><strong>Affected:</strong> tensorflow</p> <p>In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.</p> https://cve.radiocsirt.org/vuln/cve-2020-26267 https://cve.radiocsirt.org/vuln/ghsa-c9f3-9wfr-wgh7 <p><strong>Affected:</strong> PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu</p> <p>### Impact The `tf.raw_ops.DataFormatVecPermute` API does not validate the `src_format` and `dst_format` attributes. [The code](https://github.com/tensorflow/tensorflow/blob/304b96815324e6a73d046df10df6626d63ac12ad/tensorflow/core/kernels/data_format_ops.cc) assumes that these two arguments define a permutation of `NHWC`.</p> <p>However, these assumptions are not checked and this can result in uninitialized memory accesses, read outside of bounds and even crashes.</p> <p>```python &gt;&gt;&gt; import tensorflow as tf &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format=&#39;1234&#39;, dst_format=&#39;1234&#39;) &lt;tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 757100143], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format=&#39;HHHH&#39;, dst_format=&#39;WWWW&#39;) &lt;tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 32701], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format=&#39;H&#39;, dst_format=&#39;W&#39;) &lt;tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 32701], dtype=int32)&gt; &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], src_format=&#39;1234&#39;, dst_format=&#39;1253&#39;) &lt;tf.Tensor: shape=(4,), dtype=int32, numpy=array([4, 2, 939037184, 3], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], src_format=&#39;1234&#39;, dst_format=&#39;1223&#39;) &lt;tf.Tensor: shape=(4,), dtype=int32, numpy=array([4, 32701, 2, 3], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], src_format=…</p> <p><strong>Affected:</strong> PyPI: tensorflow, PyPI: tensorflow-cpu, PyPI: tensorflow-gpu</p> <p>### Impact The `tf.raw_ops.DataFormatVecPermute` API does not validate the `src_format` and `dst_format` attributes. [The code](https://github.com/tensorflow/tensorflow/blob/304b96815324e6a73d046df10df6626d63ac12ad/tensorflow/core/kernels/data_format_ops.cc) assumes that these two arguments define a permutation of `NHWC`.</p> <p>However, these assumptions are not checked and this can result in uninitialized memory accesses, read outside of bounds and even crashes.</p> <p>```python &gt;&gt;&gt; import tensorflow as tf &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format=&#39;1234&#39;, dst_format=&#39;1234&#39;) &lt;tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 757100143], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format=&#39;HHHH&#39;, dst_format=&#39;WWWW&#39;) &lt;tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 32701], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format=&#39;H&#39;, dst_format=&#39;W&#39;) &lt;tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 32701], dtype=int32)&gt; &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], src_format=&#39;1234&#39;, dst_format=&#39;1253&#39;) &lt;tf.Tensor: shape=(4,), dtype=int32, numpy=array([4, 2, 939037184, 3], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], src_format=&#39;1234&#39;, dst_format=&#39;1223&#39;) &lt;tf.Tensor: shape=(4,), dtype=int32, numpy=array([4, 32701, 2, 3], dtype=int32)&gt; ... &gt;&gt;&gt; tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], src_format=…</p> https://cve.radiocsirt.org/vuln/ghsa-c9f3-9wfr-wgh7