CVE-2021-41196 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2021-41196 Interim 1 4 2025-02-17T00:27:03Z current 2021-11-09T02:08:24Z 2025-02-17T00:27:03Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2021-41196 TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative. This is due to the TensorFlow's implementation of pooling operations where the values in the sliding window are not checked to be strictly positive. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Tumbleweed tensorflow-lite-2.9.1-1.1 tensorflow-lite-devel-2.9.1-1.1 tensorflow-lite-2.9.1-1.1 as a component of openSUSE Tumbleweed tensorflow-lite-devel-2.9.1-1.1 as a component of openSUSE Tumbleweed TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative. This is due to the TensorFlow's implementation of pooling operations where the values in the sliding window are not checked to be strictly positive. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. CVE-2021-41196 openSUSE Tumbleweed:tensorflow-lite-2.9.1-1.1 openSUSE Tumbleweed:tensorflow-lite-devel-2.9.1-1.1 important 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H