CVE-2018-7575: Integer Overflow or Wraparound in Google TensorFlow
Summary
CVE-2018-7575: Integer Overflow or Wraparound in Google TensorFlow. Affects tensorflow versions >= 1.0.0, < 1.7.1. Fixed in 1.7.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2018-7575 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Google TensorFlow is an open-source machine learning framework used for building and training neural networks. It provides a comprehensive set of tools and libraries for numerical computation and data flow graphs. TensorFlow is widely adopted in various domains, including research, industry, and academia. However, versions 1.7.x and earlier of TensorFlow are affected by a critical vulnerability. This vulnerability is related to an integer overflow or wraparound issue, which can lead to a buffer overflow. The exploitation of this vulnerability depends on the context in which TensorFlow is used.
Vulnerability Detail
The vulnerability in Google TensorFlow arises due to an integer overflow or wraparound. An attacker can exploit this vulnerability to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service. The impact of this vulnerability can vary depending on the specific usage scenario of TensorFlow. It is crucial to address this vulnerability promptly to prevent potential security breaches and ensure the integrity and stability of TensorFlow-based systems.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==1.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade TensorFlow to the patched version.
Conclusion
In conclusion, the vulnerability identified as CVE-2018-7575 in Google TensorFlow versions 1.7.x and earlier poses a significant risk to the security and stability of TensorFlow-based systems. It is crucial to upgrade to the patched version (1.7.1 or later) to mitigate the vulnerability and ensure the integrity of the systems. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
Google TensorFlow is an open-source machine learning framework used for building and training neural networks. It provides a comprehensive set of tools and libraries for numerical computation and data flow graphs.
The impact of this vulnerability can vary depending on the specific usage scenario of TensorFlow. It can potentially lead to arbitrary code execution or denial of service.
To fix this vulnerability, it is recommended to upgrade TensorFlow to version 1.7.1 or later.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade TensorFlow to the patched version.
For more information about this vulnerability, you can refer to the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/04/GHSA-mw6v-crh8-8533/GHSA-mw6v-crh8-8533.json
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
