diff --git a/advisories/github-reviewed/2020/05/GHSA-h98h-8mxr-m8gx/GHSA-h98h-8mxr-m8gx.json b/advisories/github-reviewed/2020/05/GHSA-h98h-8mxr-m8gx/GHSA-h98h-8mxr-m8gx.json index f4ad121f0d0..4a0b90bbc90 100644 --- a/advisories/github-reviewed/2020/05/GHSA-h98h-8mxr-m8gx/GHSA-h98h-8mxr-m8gx.json +++ b/advisories/github-reviewed/2020/05/GHSA-h98h-8mxr-m8gx/GHSA-h98h-8mxr-m8gx.json @@ -1,17 +1,21 @@ { "schema_version": "1.4.0", "id": "GHSA-h98h-8mxr-m8gx", - "modified": "2021-08-25T21:09:12Z", + "modified": "2024-08-28T13:31:34Z", "published": "2020-05-13T16:01:35Z", "aliases": [ "CVE-2018-21233" ], "summary": "Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.", - "details": "TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.", + "details": "TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in `core/kernels/decode_bmp_op.cc`.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ @@ -33,6 +37,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "tensorflow-gpu" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.7.0" + } + ] + } + ] } ], "references": [ @@ -45,7 +68,7 @@ "url": "https://github.com/tensorflow/tensorflow/commit/49f73c55d56edffebde4bca4a407ad69c1cae433" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/tensorflow/tensorflow" }, {