CVE-2022-41197
published 2022-10-11CVE-2022-41197: Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual…
PriorityP432high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.23%
13.3th percentile
Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| intel | optimization_for_tensorflow | >= 0 < 2.5.3 | 2.5.3 |
| intel | optimization_for_tensorflow | >= 2.6.0 < 2.6.3 | 2.6.3 |
| intel | optimization_for_tensorflow | >= 2.7.0 < 2.7.1 | 2.7.1 |
| sap | 3d_visual_enterprise_viewer | < 9.0 | 9.0 |
| sap_se | sap_3d_visual_enterprise_viewer | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g3f9-cx7h-5hwr: Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (
ghsa_unreviewed·2022-10-12
CVE-2022-41197 [HIGH] CWE-119 GHSA-g3f9-cx7h-5hwr: Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (
Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
GHSA
`CHECK`-fails when building invalid tensor shapes in Tensorflow
ghsa·2022-02-09·CVSS 5.5
CVE-2022-23569 [MEDIUM] CWE-617 `CHECK`-fails when building invalid tensor shapes in Tensorflow
`CHECK`-fails when building invalid tensor shapes in Tensorflow
### Impact
Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). This is similar to [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197) and has similar fixes.
### Patches
We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
### For more information
Please consu
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-10-11
Published