deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39413
Published: 2021-11-05
Description: Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, and (j) reports.php; the (2) from_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, (j) webmaster-tools.php, and (k) reports.php; the (3) order_col parameter in (a) analytics.php, (b) review.php, (c) social_media.php, and (d) webmaster-tools.php; and the (4) pageno parameter in (a) alerts.php, (b) log.php, (c) keywords.php, (d) proxy.php, (e) searchengine.php, and (f) siteauditor.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sisl.lab.uic.edu/projects/chess/seo-panel/; https://sisl.lab.uic.edu/projects/chess/seo-panel/
CVE: CVE-2021-39416
Published: 2021-11-05
Description: Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/remoteclinic/RemoteClinic/issues/17; https://remoteclinic.io; https://sisl.lab.uic.edu/projects/chess/remote-clinic/
CVE: CVE-2021-42543
Published: 2021-11-05
Description: The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown.
CVSS Score: 7.8 (HIGH)
CWE: CWE-242
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02
CVE: CVE-2021-42698
Published: 2021-11-05
Description: Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02
CVE: CVE-2021-42699
Published: 2021-11-05
Description: The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-319
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02
CVE: CVE-2021-42701
Published: 2021-11-05
Description: An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-471
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-308-02
CVE: CVE-2020-23565
Published: 2021-11-05
Description: Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. Related to a "Data from Faulting Address controls Branch Selection starting at JPEG2000!ShowPlugInSaveOptions_W+0x[PII_REDACTED]032850".
CVSS Score: 7.8 (HIGH)
References: https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/3; https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/3
CVE: CVE-2020-23566
Published: 2021-11-05
Description: Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/1; https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/1
CVE: CVE-2020-23567
Published: 2021-11-05
Description: Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. Related to "Integer Divide By Zero starting at JPEG2000!ShowPlugInSaveOptions_W+0x[PII_REDACTED]0082ea"
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/2; https://github.com/KamasuOri/publicResearch/tree/master/poc/irfanview/2
CVE: CVE-2021-29753
Published: 2021-11-05
Description: IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201919; https://www.ibm.com/support/pages/node/6513703; https://exchange.xforce.ibmcloud.com/vulnerabilities/201919
CVE: CVE-2021-35368
Published: 2021-11-05
Description: OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.
CVSS Score: 9.8 (CRITICAL)
References: https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/; https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MS5GMNYHFFIBWLJW7N3XAD24SLF3PFZ/
CVE: CVE-2021-42837
Published: 2021-11-05
Description: An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://jira.talendforge.org/browse/TAPACHE-180; https://www.talend.com/resources/; https://jira.talendforge.org/browse/TAPACHE-180
CVE: CVE-2021-43404
Published: 2021-11-05
Description: An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.
CVSS Score: 8.8 (HIGH)
References: https://github.com/fusionpbx/fusionpbx/commit/487afc371e5c0dfbbc07cd002333c5bcd949d0f4; https://github.com/fusionpbx/fusionpbx/commit/487afc371e5c0dfbbc07cd002333c5bcd949d0f4
CVE: CVE-2021-43405
Published: 2021-11-05
Description: An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric).
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/164795/FusionPBX-4.5.29-Remote-Code-Execution.html; https://github.com/fusionpbx/fusionpbx/commit/2d2869c1a1e874c46a8c3c5475614ce769bbbd59; http://packetstormsecurity.com/files/164795/FusionPBX-4.5.29-Remote-Code-Execution.html
CVE: CVE-2021-43406
Published: 2021-11-05
Description: An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values).
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/fusionpbx/fusionpbx/commit/0377b2152c0e59c8f35297f9a9b6ee335a62d963; https://github.com/fusionpbx/fusionpbx/commit/0377b2152c0e59c8f35297f9a9b6ee335a62d963
CVE: CVE-2021-41195
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using `AddDim`. However, if the number of elements in the tensor overflows an `int64_t` value, `AddDim` results in a `CHECK` failure which provokes a `std::abort`. Instead, code should use `AddDimWithStatus`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/tensorflow/tensorflow/commit/e9c81c1e1a9cd8dd31f4e83676cab61b60658429; https://github.com/tensorflow/tensorflow/issues/46888; https://github.com/tensorflow/tensorflow/pull/51733
CVE: CVE-2021-41196
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative. This is due to the TensorFlow's implementation of pooling operations where the values in the sliding window are not checked to be strictly positive. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191, CWE-191
References: https://github.com/tensorflow/tensorflow/commit/12b1ff82b3f26ff8de17e58703231d5a02ef1b8b; https://github.com/tensorflow/tensorflow/issues/51936; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m539-j985-hcr8
CVE: CVE-2021-41197
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions TensorFlow allows tensor to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an `int64_t`. If an overflow occurs, `MultiplyWithoutOverflow` would return a negative result. In the majority of TensorFlow codebase this then results in a `CHECK`-failure. Newer constructs exist which return a `Status` instead of crashing the binary. This is similar to CVE-2021-29584. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/tensorflow/tensorflow/commit/7c1692bd417eb4f9b33ead749a41166d6080af85; https://github.com/tensorflow/tensorflow/commit/a871989d7b6c18cdebf2fb4f0e5c5b62fbc19edf; https://github.com/tensorflow/tensorflow/commit/d81b1351da3e8c884ff836b64458d94e4a157c15
CVE: CVE-2021-41198
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/tensorflow/tensorflow/commit/9294094df6fea79271778eb7e7ae1bad8b5ef98f; https://github.com/tensorflow/tensorflow/issues/46911; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2p25-55c9-h58q
CVE: CVE-2021-41199
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/tensorflow/tensorflow/commit/e5272d4204ff5b46136a1ef1204fc00597e21837; https://github.com/tensorflow/tensorflow/issues/46914; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5hx2-qx8j-qjqm
CVE: CVE-2021-41200
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions if `tf.summary.create_file_writer` is called with non-scalar arguments code crashes due to a `CHECK`-fail. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/tensorflow/tensorflow/commit/874bda09e6702cd50bac90b453b50bcc65b2769e; https://github.com/tensorflow/tensorflow/issues/46909; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gh8h-7j2j-qv4f
CVE: CVE-2021-41201
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affeced versions during execution, `EinsumHelper::ParseEquation()` is supposed to set the flags in `input_has_ellipsis` vector and `*output_has_ellipsis` boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to `true` and never assigns `false`. This results in unitialized variable access if callers assume that `EinsumHelper::ParseEquation()` always sets these flags. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://github.com/tensorflow/tensorflow/commit/f09caa532b6e1ac8d2aa61b7832c78c5b79300c6; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j86v-p27c-73fm; https://github.com/tensorflow/tensorflow/commit/f09caa532b6e1ac8d2aa61b7832c78c5b79300c6
CVE: CVE-2021-41210
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for `SparseCountSparseOutput` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/701cfaca222a82afbeeb17496bd718baa65a67d2; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m342-ff57-4jcc; https://github.com/tensorflow/tensorflow/commit/701cfaca222a82afbeeb17496bd718baa65a67d2
CVE: CVE-2021-3774
Published: 2021-11-05
Description: Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in its initial setup. This could allow a remote attacker to obtain the Wi-Fi SSID as well as the password configured by the user from Meross app via Http/JSON plain request.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.incibe.es/en/incibe-cert/notices/aviso/meross-mss550x-missing-encryption-sensitive-data; https://www.incibe.es/en/incibe-cert/notices/aviso/meross-mss550x-missing-encryption-sensitive-data
CVE: CVE-2021-41203
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345, CWE-190
References: https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec; https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578; https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad
CVE: CVE-2021-41204
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824, CWE-824
References: https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d[PII_REDACTED]56659; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x; https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d[PII_REDACTED]56659
CVE: CVE-2021-41205
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-49rx-x2rw-pc6f; https://github.com/tensorflow/tensorflow/commit/7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d
CVE: CVE-2021-41211
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds of heap allocated array. This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer. The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/a0d64445116c43cf46a5666bd4eee28e7a82f244; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cvgx-3v3q-m36c; https://github.com/tensorflow/tensorflow/commit/a0d64445116c43cf46a5666bd4eee28e7a82f244
CVE: CVE-2021-41212
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fr77-rrx3-cp7g; https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8
CVE: CVE-2021-41214
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` has an undefined behavior due to binding a reference to `nullptr`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vwhq-49r4-gj9v; https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8
CVE: CVE-2021-41215
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer dereference. This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/tensorflow/tensorflow/commit/d3738dd70f1c9ceb547258cbb82d853da8771850; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-x3v8-c8qx-3j3r; https://github.com/tensorflow/tensorflow/commit/d3738dd70f1c9ceb547258cbb82d853da8771850
CVE: CVE-2021-41217
Published: 2021-11-05
Description: TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/tensorflow/tensorflow/commit/05cbebd3c6bb8f517a158b0155debb8df79017ff; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5crj-c72x-m7gq; https://github.com/tensorflow/tensorflow/commit/05cbebd3c6bb8f517a158b0155debb8df79017ff