id: PYSEC-2020-133
details: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1,
  if a TFLite saved model uses the same tensor as both input and output of an operator,
  then, depending on the operator, we can observe a segmentation fault or just memory
  corruption. We have patched the issue in d58c96946b and will release patch releases
  for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow
  1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
affected:
- package:
    name: tensorflow
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: d58c96946b2880991d63d1dacacb32f0a4dfa453
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.15.4
    - introduced: 2.0.0
    - fixed: 2.0.3
    - introduced: 2.1.0
    - fixed: 2.1.2
    - introduced: 2.2.0
    - fixed: 2.2.1
    - introduced: 2.3.0
    - fixed: 2.3.1
  versions:
  - 0.12.0rc0
  - 0.12.0rc1
  - 0.12.0
  - 0.12.1
  - 1.0.0
  - 1.0.1
  - 1.1.0rc0
  - 1.1.0rc1
  - 1.1.0rc2
  - 1.1.0
  - 1.2.0rc0
  - 1.2.0rc1
  - 1.2.0rc2
  - 1.2.0
  - 1.2.1
  - 1.3.0rc0
  - 1.3.0rc1
  - 1.3.0rc2
  - 1.3.0
  - 1.4.0rc0
  - 1.4.0rc1
  - 1.4.0
  - 1.4.1
  - 1.5.0rc0
  - 1.5.0rc1
  - 1.5.0
  - 1.5.1
  - 1.6.0rc0
  - 1.6.0rc1
  - 1.6.0
  - 1.7.0rc0
  - 1.7.0rc1
  - 1.7.0
  - 1.7.1
  - 1.8.0rc0
  - 1.8.0rc1
  - 1.8.0
  - 1.9.0rc0
  - 1.9.0rc1
  - 1.9.0rc2
  - 1.9.0
  - 1.10.0rc0
  - 1.10.0rc1
  - 1.10.0
  - 1.10.1
  - 1.11.0rc0
  - 1.11.0rc1
  - 1.11.0rc2
  - 1.11.0
  - 1.12.0rc0
  - 1.12.0rc1
  - 1.12.0rc2
  - 1.12.0
  - 1.12.2
  - 1.12.3
  - 1.13.0rc0
  - 1.13.0rc1
  - 1.13.0rc2
  - 1.13.1
  - 1.13.2
  - 1.14.0rc0
  - 1.14.0rc1
  - 1.14.0
  - 1.15.0rc0
  - 1.15.0rc1
  - 1.15.0rc2
  - 1.15.0rc3
  - 1.15.0
  - 1.15.2
  - 1.15.3
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.1.0
  - 2.1.1
  - 2.2.0
  - 2.3.0
references:
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/d58c96946b2880991d63d1dacacb32f0a4dfa453
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-x9j7-x98r-r4w2
- type: WEB
  url: https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
- type: WEB
  url: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
aliases:
- CVE-2020-15210
- GHSA-x9j7-x98r-r4w2
modified: "2020-10-29T16:15:00Z"
published: "2020-09-25T19:15:00Z"