nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which might be untrusted.
Date: 2019-04
Affected: sony/neural_network_libraries
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2019-10844
CVSS: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which might be untrusted.


Mitigations:

Architectural layers (MAESTRO):