tensorflow/security/advisory/tfsa-2019-002.md
UnsortedSegmentSumCVE-2019-16778
A heap buffer overflow in UnsortedSegmentSum can be produced when the Index
template argument is int32. In this case data_size and num_segments fields
are truncated from int64 to int32 and can produce negative numbers,
resulting in accessing out of bounds heap memory.
This is unlikely to be exploitable and was detected and fixed internally. We are making the security advisory only to notify users that it is better to update to TensorFlow 1.15 or 2.0 or later as these versions already have this fixed.
TensorFlow 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.10.0, 1.10.1, 1.11.0, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.13.0, 1.13.1, 1.13.2, 1.14.0.
We have patched the vulnerability in GitHub commit db4f971.
We encourage users to switch to TensorFlow 1.15 or 2.0 as these versions contain the fix. If switching is undesirable, consider cherry-picking the above commit and building from source.