CVE-2019-9635 NULL Pointer Dereference in Google TensorFlow
An attacker can cause a denial of service in TensorFlow by providing a specially crafted invalid GIF file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-9635?
CVE-2019-9635 is a medium-severity vulnerability in Google Tensorflow, published on 24 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.
Weakness: CWE-476
Which versions are affected by CVE-2019-9635?
7 open source packages ship an affected version, including tensorflow, tensorflow-cpu and tensorflow-gpu. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tensorflow PyPI | All versions | 1.12.2 |
tensorflow PyPI | From 1.0.0 | 1.12.1 |
tensorflow PyPI | From 1.0.0 | 1.12.1 |
tensorflow-cpu PyPI | All versions | 1.12.2 |
tensorflow-gpu PyPI | All versions | 1.12.2 |
tensorflow-gpu PyPI | From 1.0.0 | 1.12.1 |
1 more packages
tensorflow-gpu PyPI | From 1.0.0 | 1.12.1 |
Products include Google Tensorflow.
How do I fix CVE-2019-9635?
Upgrade tensorflow to a fixed version for your release line: 1.12.2 or 1.12.1.
Is CVE-2019-9635 being exploited?
There is no known exploitation of CVE-2019-9635 in the wild and no public exploit code.
Other vulnerabilities in Google Tensorflow
- CVE-2023-25668 TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation
- CVE-2018-7575 Integer Overflow or Wraparound in Google TensorFlow
- CVE-2021-37678 Arbitrary code execution due to YAML deserialization
- CVE-2021-35958 Path traversal in n/a
- CVE-2020-15202 Integer truncation in Shard API usage
Sources
Also known as GHSA-mfg7-x5m7-6p8w, PYSEC-2019-210, PYSEC-2019-228, PYSEC-2019-235.