Tensorflow

Latest version: v2.18.0

Safety actively analyzes 682387 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 12 of 18

2.0.0

Not secure
Major Features and Improvements

1.15.5

Not secure
Note that this is the last patch release for the TensorFlow 1.x series.

Bug Fixes and Other Changes

* Fixes an access to unitialized memory in Eigen code
([CVE-2020-26266](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26266))
* Fixes a security vulnerability caused by lack of validation in
`tf.raw_ops.DataFormatVecPermute` and `tf.raw_ops.DataFormatDimMap`
([CVE-2020-26267](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26267))
* Fixes a vulnerability caused by attempting to write to immutable memory
region in `tf.raw_ops.ImmutableConst`
([CVE-2020-26268](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26268)
* Fixes a `CHECK`-fail in LSTM with zero-length input
([CVE-2020-26270](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26270))
* Fixes a security vulnerability caused by accessing heap data outside of
bounds when loading a specially crafted `SavedModel`
([CVE-2020-26271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26271))
* Updates `libjpeg-turbo` to `2.0.5` to handle
[CVE-2020-13790](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13790).
* Updates `junit` to `4.13.1` to handle
[CVE-2020-15250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250).
* Updates `PCRE` to `8.44` to handle
[CVE-2019-20838](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838)
and
[CVE-2020-14155](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155).
* Updates `sqlite3` to `3.44.0` to keep in sync with master branch.

1.15.4

Not secure
Bug Fixes and Other Changes

* Fixes an undefined behavior causing a segfault in `tf.raw_ops.Switch`
([CVE-2020-15190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15190))
* Fixes three vulnerabilities in conversion to DLPack format
([CVE-2020-15191](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15191),
[CVE-2020-15192](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15192),
[CVE-2020-15193](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15193))
* Fixes two vulnerabilities in `SparseFillEmptyRowsGrad`
([CVE-2020-15194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15194),
[CVE-2020-15195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15195))
* Fixes an integer truncation vulnerability in code using the work sharder API
([CVE-2020-15202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15202))
* Fixes a format string vulnerability in `tf.strings.as_string`
([CVE-2020-15203](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15203))
* Fixes segfault raised by calling session-only ops in eager mode
([CVE-2020-15204](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15204))
* Fixes data leak and potential ASLR violation from `tf.raw_ops.StringNGrams`
([CVE-2020-15205](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15205))
* Fixes segfaults caused by incomplete `SavedModel` validation
([CVE-2020-15206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15206))
* Fixes a data corruption due to a bug in negative indexing support in TFLite
([CVE-2020-15207](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15207))
* Fixes a data corruption due to dimension mismatch in TFLite
([CVE-2020-15208](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15208))
* Fixes several vulnerabilities in TFLite saved model format
([CVE-2020-15209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15209),
[CVE-2020-15210](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15210),
[CVE-2020-15211](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15211))
* Updates `sqlite3` to `3.33.00` to handle
[CVE-2020-9327](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9327),
[CVE-2020-11655](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11655),
[CVE-2020-11656](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11656),
[CVE-2020-13434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434),
[CVE-2020-13435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13435),
[CVE-2020-13630](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13630),
[CVE-2020-13631](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13631),
[CVE-2020-13871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13871),
and
[CVE-2020-15358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358).
* Fixes 41630 by including `max_seq_length` in CuDNN descriptor cache key
* Pins `numpy` to 1.18.5 to prevent ABI breakage when compiling code that uses
both NumPy and TensorFlow headers.

1.15.3

Not secure
Bug Fixes and Other Changes

* Updates `sqlite3` to `3.31.01` to handle
[CVE-2019-19880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19880),
[CVE-2019-19244](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19244)
and
[CVE-2019-19645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19645)
* Updates `curl` to `7.69.1` to handle
[CVE-2019-15601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15601)
* Updates `libjpeg-turbo` to `2.0.4` to handle
[CVE-2018-19664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19664),
[CVE-2018-20330](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20330)
and
[CVE-2019-13960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13960)
* Updates Apache Spark to `2.4.5` to handle
[CVE-2019-10099](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10099),
[CVE-2018-17190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17190)
and
[CVE-2018-11770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11770)

1.15.2

Not secure
Bug Fixes and Other Changes

* Fixes a security vulnerability where converting a Python string to a
`tf.float16` value produces a segmentation fault
([CVE-2020-5215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5215))
* Updates `curl` to `7.66.0` to handle
[CVE-2019-5482](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482)
and
[CVE-2019-5481](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481)
* Updates `sqlite3` to `3.30.01` to handle
[CVE-2019-19646](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19646),
[CVE-2019-19645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19645)
and
[CVE-2019-16168](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16168)

1.15.0

Not secure
This is the last 1.x release for TensorFlow. We do not expect to update the 1.x
branch with features, although we will issue patch releases to fix
vulnerabilities for at least one year.

Major Features and Improvements

* As
[announced](https://groups.google.com/a/tensorflow.org/forum/#!topic/developers/iRCt5m4qUz0),
`tensorflow` pip package will by default include GPU support (same as
`tensorflow-gpu` now) for the platforms we currently have GPU support (Linux
and Windows). It will work on machines with and without Nvidia GPUs.
`tensorflow-gpu` will still be available, and CPU-only packages can be
downloaded at `tensorflow-cpu` for users who are concerned about package
size.
* TensorFlow 1.15 contains a complete implementation of the 2.0 API in its
`compat.v2` module. It contains a copy of the 1.15 main module (without
`contrib`) in the `compat.v1` module. TensorFlow 1.15 is able to emulate 2.0
behavior using the `enable_v2_behavior()` function. This enables writing
forward compatible code: by explicitly importing either
`tensorflow.compat.v1` or `tensorflow.compat.v2`, you can ensure that your
code works without modifications against an installation of 1.15 or 2.0.
* EagerTensor now supports numpy buffer interface for tensors.
* Add toggles `tf.enable_control_flow_v2()` and `tf.disable_control_flow_v2()`
for enabling/disabling v2 control flow.
* Enable v2 control flow as part of `tf.enable_v2_behavior()` and
`TF2_BEHAVIOR=1`.
* AutoGraph translates Python control flow into TensorFlow expressions,
allowing users to write regular Python inside `tf.function`-decorated
functions. AutoGraph is also applied in functions used with `tf.data`,
`tf.distribute` and `tf.keras` APIS.
* Adds `enable_tensor_equality()`, which switches the behavior such that:
* Tensors are no longer hashable.
* Tensors can be compared with `==` and `!=`, yielding a Boolean Tensor
with element-wise comparison results. This will be the default behavior
in 2.0.

Breaking Changes

* Tensorflow code now produces 2 different pip packages: `tensorflow_core`
containing all the code (in the future it will contain only the private
implementation) and `tensorflow` which is a virtual pip package doing
forwarding to `tensorflow_core` (and in the future will contain only the
public API of tensorflow). We don't expect this to be breaking, unless you
were importing directly from the implementation.
* TensorFlow 1.15 is built using devtoolset7 (GCC7) on Ubuntu 16. This may
lead to ABI incompatibilities with extensions built against earlier versions
of TensorFlow.
* Deprecated the use of `constraint=` and `.constraint` with ResourceVariable.
* `tf.keras`:
* `OMP_NUM_THREADS` is no longer used by the default Keras config. To
configure the number of threads, use `tf.config.threading` APIs.
* `tf.keras.model.save_model` and `model.save` now defaults to saving a
TensorFlow SavedModel.
* `keras.backend.resize_images` (and consequently,
`keras.layers.Upsampling2D`) behavior has changed, a bug in the resizing
implementation was fixed.
* Layers now default to `float32`, and automatically cast their inputs to
the layer's dtype. If you had a model that used `float64`, it will
probably silently use `float32` in TensorFlow2, and a warning will be
issued that starts with Layer "layer-name" is casting an input tensor
from dtype float64 to the layer's dtype of float32. To fix, either set
the default dtype to float64 with
`tf.keras.backend.set_floatx('float64')`, or pass `dtype='float64'` to
each of the Layer constructors. See `tf.keras.layers.Layer` for more
information.
* Some `tf.assert_*` methods now raise assertions at operation creation
time (i.e. when this Python line executes) if the input tensors' values
are known at that time, not during the session.run(). When this happens,
a noop is returned and the input tensors are marked non-feedable. In
other words, if they are used as keys in `feed_dict` argument to
`session.run()`, an error will be raised. Also, because some assert ops
don't make it into the graph, the graph structure changes. A different
graph can result in different per-op random seeds when they are not
given explicitly (most often).

Bug Fixes and Other Changes

* `tf.estimator`:
* `tf.keras.estimator.model_to_estimator` now supports exporting to
`tf.train.Checkpoint` format, which allows the saved checkpoints to be
compatible with `model.load_weights`.
* Fix tests in canned estimators.
* Expose Head as public API.
* Fixes critical bugs that help with `DenseFeatures` usability in TF2
* `tf.data`:
* Promoting `unbatch` from experimental to core API.
* Adding support for datasets as inputs to `from_tensors` and
`from_tensor_slices` and batching and unbatching of nested datasets.
* `tf.keras`:
* `tf.keras.estimator.model_to_estimator` now supports exporting to
tf.train.Checkpoint format, which allows the saved checkpoints to be
compatible with `model.load_weights`.
* Saving a Keras Model using `tf.saved_model.save` now saves the list of
variables, trainable variables, regularization losses, and the call
function.
* Deprecated `tf.keras.experimental.export_saved_model` and
`tf.keras.experimental.function`. Please use
`tf.keras.models.save_model(..., save_format='tf')` and
`tf.keras.models.load_model` instead.
* Add an `implementation=3` mode for `tf.keras.layers.LocallyConnected2D`
and `tf.keras.layers.LocallyConnected1D` layers using `tf.SparseTensor`
to store weights, allowing a dramatic speedup for large sparse models.
* Enable the Keras compile API `experimental_run_tf_function` flag by
default. This flag enables single training/eval/predict execution path.
With this 1. All input types are converted to `Dataset`. 2. When
distribution strategy is not specified this goes through the no-op
distribution strategy path. 3. Execution is wrapped in tf.function
unless `run_eagerly=True` is set in compile.
* Raise error if `batch_size` argument is used when input is
dataset/generator/keras sequence.
* `tf.lite`
* Add `GATHER` support to NN API delegate.
* tflite object detection script has a debug mode.
* Add delegate support for `QUANTIZE`.
* Added evaluation script for COCO minival.
* Add delegate support for `QUANTIZED_16BIT_LSTM`.
* Converts hardswish subgraphs into atomic ops.
* Add support for defaulting the value of `cycle_length` argument of
`tf.data.Dataset.interleave` to the number of schedulable CPU cores.
* `parallel_for`: Add converter for `MatrixDiag`.
* Add `narrow_range` attribute to `QuantizeAndDequantizeV2` and V3.
* Added new op: `tf.strings.unsorted_segment_join`.
* Add HW acceleration support for `topK_v2`.
* Add new `TypeSpec` classes.
* CloudBigtable version updated to v0.10.0.
* Expose `Head` as public API.
* Update docstring for gather to properly describe the non-empty `batch_dims`
case.
* Added `tf.sparse.from_dense` utility function.
* Improved ragged tensor support in `TensorFlowTestCase`.
* Makes the a-normal form transformation in Pyct configurable as to which
nodes are converted to variables and which are not.
* `ResizeInputTensor` now works for all delegates.
* Add `EXPAND_DIMS` support to NN API delegate TEST: expand_dims_test
* `tf.cond` emits a StatelessIf op if the branch functions are stateless and
do not touch any resources.
* `tf.cond`, `tf.while` and `if` and `while` in AutoGraph now accept a
nonscalar predicate if has a single element. This does not affect non-V2
control flow.
* `tf.while_loop` emits a StatelessWhile op if the cond and body functions are
stateless and do not touch any resources.
* Refactors code in Quant8 LSTM support to reduce TFLite binary size.
* Add support of local soft device placement for eager op.
* Add HW acceleration support for `LogSoftMax`.
* Added a function `nested_value_rowids` for ragged tensors.
* Add guard to avoid acceleration of L2 Normalization with input rank != 4
* Add `tf.math.cumulative_logsumexp operation`.
* Add `tf.ragged.stack`.
* Fix memory allocation problem when calling `AddNewInputConstantTensor`.
* Delegate application failure leaves interpreter in valid state.
* Add check for correct memory alignment to
`MemoryAllocation::MemoryAllocation()`.
* Extracts `NNAPIDelegateKernel` from nnapi_delegate.cc
* Added support for `FusedBatchNormV3` in converter.
* A ragged to dense op for directly calculating tensors.
* Fix accidental quadratic graph construction cost in graph-mode
`tf.gradients()`.

Thanks to our Contributors

This release contains contributions from many people at Google, as well as:

a6802739, Aaron Ma, Abdullah Selek, Abolfazl Shahbazi, Ag Ramesh, Albert Z. Guo,
Albin Joy, Alex Itkes, Alex Sergeev, Alexander Pivovarov, Alexey Romanov,
alhkad, Amit Srivastava, amoitra, Andrew Lihonosov, Andrii Prymostka, Anuj
Rawat, Astropeak, Ayush Agrawal, Bairen Yi, Bas Aarts, Bastian Eichenberger, Ben
Barsdell, Benjamin Peterson, bhack, Bharat Raghunathan, Bhavani Subramanian,
Bryan Cutler, candy.dc, Cao Zongyan, Captain-Pool, Casper Da Costa-Luis, Chen
Guoyin, Cheng Chang, chengchingwen, Chong Yan, Choong Yin Thong, Christopher
Yeh, Clayne Robison, Coady, Patrick, Dan Ganea, David Norman, Denis Khalikov,
Deven Desai, Diego Caballero, Duncan Dean, Duncan Riach, Dwight J Lyle, Eamon
Ito-Fisher, eashtian3, EFanZh, ejot, Elroy Ashtian Jr, Eric Schweitz, Fangjun
Kuang, Fei Hu, fo40225, formath, Fred Reiss, Frederic Bastien, Fredrik Knutsson,
G. Hussain Chinoy, Gabriel, gehring, George Grzegorz Pawelczak, Gianluca
Varisco, Gleb Popov, Greg Peatfield, Guillaume Klein, Gurpreet Singh, Gustavo
Lima Chaves, haison, Haraldur TóMas HallgríMsson, HarikrishnanBalagopal, HåKon
Sandsmark, I-Hong, Ilham Firdausi Putra, Imran Salam, Jason Zaman, Jason
Zavaglia, jayhpark530, jefby, Jeff Daily, Jeffrey Poznanovic, Jekyll Lai, Jeroen
BéDorf, Jerry Shih, jerryyin, jiakai, JiangXIAO, Joe Bowser, Joel Shapiro, Johan
Gunnarsson, Jojimon Varghese, Joon, Josh Beal, Julian Niedermeier, Jun Wan,
Junqin Zhang, Junyuan Xie, Justin Tunis, Kaixi Hou, Karl Lessard, Karthik
Muthuraman, Kbhute-Ibm, khanhlvg, Koock Yoon, kstuedem, Kyuwon Kim, Lakshay
Tokas, leike666666, leonard951, Leslie-Fang, Leslie-Fang-Intel, Li, Guizi, Lukas
Folle, Lukas Geiger, Mahmoud Abuzaina, Manraj Singh Grover, Margaret
Maynard-Reid, Mark Ryan, Matt Conley, Matthew Bentham, Matthew Denton, mbhuiyan,
mdfaijul, Mei Jie, merturl, MichaelKonobeev, Michal W. Tarnowski, minds, mpppk,
musikisomorphie, Nagy Mostafa, Nayana Thorat, Neil, Niels Ole Salscheider,
Niklas SilfverströM, Niranjan Hasabnis, ocjosen, olramde, Pariksheet Pinjari,
Patrick J. Lopresti, Patrik Gustavsson, per1234, PeterLee, Phan Van Nguyen Duc,
Phillip Kravtsov, Pooya Davoodi, Pranav Marathe, Putra Manggala, Qingqing Cao,
Rajeshwar Reddy T, Ramon ViñAs, Rasmus Diederichsen, Reuben Morais, richardbrks,
robert, RonLek, Ryan Jiang, saishruthi, Saket Khandelwal, Saleem Abdulrasool,
Sami Kama, Sana-Damani, Sergii Khomenko, Severen Redwood, Shubham Goyal, Sigrid
Keydana, Siju Samuel, sleighsoft, smilu97, Son Tran, Srini511,
srinivasan.narayanamoorthy, Sumesh Udayakumaran, Sungmann Cho, Tae-Hwan Jung,
Taehoon Lee, Takeshi Watanabe, TengLu, terryky, TheMindVirus, ThisIsIsaac, Till
Hoffmann, Timothy Liu, Tomer Gafner, Tongxuan Liu, Trent Lo, Trevor Morris, Uday
Bondhugula, Vasileios Lioutas, vbvg2008, Vishnuvardhan Janapati, Vivek
Suryamurthy, Wei Wang, Wen-Heng (Jack) Chung, wenxizhu, William D. Irons,
winstonq, wyzhao, Xiaoming (Jason) Cui, Xinan Jiang, Xinping Wang, Yann-Yy,
Yasir Modak, Yong Tang, Yongfeng Gu, Yuchen Ying, Yuxin Wu, zyeric, 王振华 (Zhenhua
Wang)

Page 12 of 18

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.