Google TensorFlow any version

Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.

Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.

TensorFlow has double free in Fractional(Max/Avg)Pool

Code injection in `saved_model_cli` in TensorFlow

Heap buffer overflow in `BandedTriangularSolve`

Stack overflow due to looping TFLite subgraph

Heap buffer overflow caused by rounding

Unitialized access in `EinsumHelper::ParseEquation`

Lack of validation in data format attributes in TensorFlow

Memory corruption in `DrawBoundingBoxesV2`

Incomplete validation in `SparseSparseMinimum`

Heap OOB and null pointer dereference in `RaggedTensorToTensor`

Incomplete validation in `SparseAdd`

Invalid validation in `SparseMatrixSparseCholesky`

Heap buffer overflow in `Conv3DBackprop*`

Interpreter crash from `tf.io.decode_raw`

Access to invalid memory during shape inference in `Cudnn*` ops

Code injection in `saved_model_cli`

Reference binding to `nullptr` in `tf.ragged.cross`

Null pointer dereference in TFLite's `Reshape` operator

Heap OOB read in TFLite

Heap buffer overflow in `Conv2DBackpropFilter`

Heap buffer overflow in `MaxPoolGrad`

Heap buffer overflow in `RaggedBinCount`

Heap out of bounds write in `RaggedBinCount`

Undefined behavior via `nullptr` reference binding in sparse matrix multiplication

Heap buffer overflow and undefined behavior in `FusedBatchNorm`

Heap buffer overflow in `AvgPool3DGrad`

Heap buffer overflow in `FractionalAvgPoolGrad`

Heap buffer overflow in `MaxPool3DGradGrad`

Heap buffer overflow in `SparseSplit`

Heap buffer overflow in `QuantizedMul`

Heap buffer overflow in `QuantizedReshape`

Heap buffer overflow in `QuantizedResizeBilinear`

Use after free in `CollectiveReduceV2`

Division by zero in TFLite's implementation of `Split`

Null dereference in Grappler's `TrySimplify`

Type confusion during tensor casts lead to dereferencing null pointers

Division by zero in TFLite's implementation of `EmbeddingLookup`

Division by zero in TFLite's implementation of `DepthToSpace`