CVE-2020-15210 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-15210 Interim 1 9 2025-02-17T01:23:15Z current 2021-05-30T14:41:55Z 2025-02-17T01:23:15Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-15210 In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TNMEEN772D6LWSHNB64QFB5TB3CZZEF4/ E-Mail link for openSUSE-SU-2020:1766-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 15.2 libtensorflow2-2.1.2-lp152.7.3.1 libtensorflow2-gnu-hpc-2.1.2-lp152.7.3.1 libtensorflow2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 libtensorflow_cc2-2.1.2-lp152.7.3.1 libtensorflow_cc2-gnu-hpc-2.1.2-lp152.7.3.1 libtensorflow_cc2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 libtensorflow_framework2-2.1.2-lp152.7.3.1 libtensorflow_framework2-gnu-hpc-2.1.2-lp152.7.3.1 libtensorflow_framework2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 tensorflow2-2.1.2-lp152.7.3.1 tensorflow2-devel-2.1.2-lp152.7.3.1 tensorflow2-doc-2.1.2-lp152.7.3.1 tensorflow2-gnu-hpc-2.1.2-lp152.7.3.1 tensorflow2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 tensorflow2-lite-2.1.2-lp152.7.3.1 tensorflow2-lite-devel-2.1.2-lp152.7.3.1 tensorflow2_2_1_2-gnu-hpc-2.1.2-lp152.7.3.1 tensorflow2_2_1_2-gnu-hpc-devel-2.1.2-lp152.7.3.1 tensorflow2_2_1_2-gnu-hpc-doc-2.1.2-lp152.7.3.1 tensorflow2_2_1_2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 tensorflow2_2_1_2-gnu-openmpi2-hpc-devel-2.1.2-lp152.7.3.1 tensorflow2_2_1_2-gnu-openmpi2-hpc-doc-2.1.2-lp152.7.3.1 libtensorflow2-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow2-gnu-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow_cc2-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow_cc2-gnu-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow_cc2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow_framework2-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow_framework2-gnu-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 libtensorflow_framework2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2-devel-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2-doc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2-gnu-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2-lite-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2-lite-devel-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2_2_1_2-gnu-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2_2_1_2-gnu-hpc-devel-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2_2_1_2-gnu-hpc-doc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2_2_1_2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2_2_1_2-gnu-openmpi2-hpc-devel-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 tensorflow2_2_1_2-gnu-openmpi2-hpc-doc-2.1.2-lp152.7.3.1 as a component of openSUSE Leap 15.2 In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. CVE-2020-15210 openSUSE Leap 15.2:libtensorflow2-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow2-gnu-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow_cc2-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow_cc2-gnu-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow_cc2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow_framework2-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow_framework2-gnu-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:libtensorflow_framework2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2-devel-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2-doc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2-gnu-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2-lite-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2-lite-devel-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2_2_1_2-gnu-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2_2_1_2-gnu-hpc-devel-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2_2_1_2-gnu-hpc-doc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2_2_1_2-gnu-openmpi2-hpc-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2_2_1_2-gnu-openmpi2-hpc-devel-2.1.2-lp152.7.3.1 openSUSE Leap 15.2:tensorflow2_2_1_2-gnu-openmpi2-hpc-doc-2.1.2-lp152.7.3.1 moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H