mirrors/tensorflow--tensorflow
1
0
Fork 0
Code Issues Pull Requests Actions 6 Deployments Models Agent Notes Packages Projects Releases Wiki Activity

chore: import upstream snapshot with attribution
cffconvert / validate (push) Has been skipped
Details
License Check / license-check (push) Failing after 2s
Details

Browse Source
This commit is contained in:
wehub-resource-sync
2026-07-13 12:14:16 +08:00
commit 8a852e4b4e
36502 changed files with 9277225 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tensorflow/security/advisory/tfsa-2019-001.md
+35
View File
@@ -0,0 +1,35 @@
## TFSA-2019-001: Null Pointer Dereference Error in Decoding GIF Files
### CVE Number
CVE-2019-9635
### Issue Description
Certain invalid GIF files can produce a null pointer dereference when reading
from the color map of a frame if the color map is missing.
### Impact
A maliciously crafted GIF file could cause a denial of service attack for
TensorFlow by making it crash.
### Vulnerable Versions
TensorFlow 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0,
1.5.1, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.10.0, 1.10.1, 1.11.0, 1.12.0
### Mitigation
We have patched the vulnerability in GitHub commit
[e41cb124](https://github.com/tensorflow/tensorflow/commit/e41cb124cd0b325821af85cdacd9d8a12e206418).
If users are loading untrusted configurations in TensorFlow, we encourage users
to apply the patch to upgrade the version of TensorFlow they are currently using.
Additionally, we have released TensorFlow version 1.12.2 to mitigate this
vulnerability. Versions 1.13.0 and later were released using the patched commit.
### Credits
This issue was discovered by Yakun Zhang and Zheng Huang of Baidu Security Lab.