CVE-2023-27579

Advisory

Tensorflow 2.11.1 and 2.12.0 include a fix for CVE-2023-27579: Constructing a tflite model with a paramater 'filter_input_channel' of less than 1 gives a FPE.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5w96-866f-6rm8

Affected package

Affected versions

Fixed versions

Vulnerability changelog

TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1. See CVE-2023-27579.


MISC:https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa: https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa
MISC:https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5w96-866f-6rm8: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5w96-866f-6rm8

Resources

• https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5w96-866f-6rm8
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27579