CVE-2018-7576: Null pointer dereference in TensorFlow… – CVSS 6.5 · Watchpost

← All vulnerabilities

Null pointer dereference in TensorFlow leads to exploitation

MEDIUM 6.5CVE-2018-7576 · GHSA-jfq2-rj7f-9gvf · PYSEC-2019-206 · Published 23/04/2019 · updated 17/06/2026

In short

CVE-2018-7576 is a MEDIUM (CVSS 6.5) vulnerability affecting tensorflow, tensorflow-cpu, tensorflow-gpu.
Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 40.2% of all vulnerabilities.
Fix: update to 1.6.0, 1.7.0rc0 or later.

Package	Affected versions	Patched versions
tensorflow PyPI	`≥ 1.0.0, < 1.6.0< 1.7.0rc0`	`1.6.01.7.0rc0`
tensorflow-cpu PyPI	`< 1.7.0rc0`	`1.7.0rc0`
tensorflow-gpu PyPI	`≥ 1.0.0, < 1.6.0< 1.7.0rc0`	`1.6.01.7.0rc0`
tensorflow google	`≤ 1.6.0`	No fix yet

Description

Google TensorFlow 1.0.0 through 1.5.1 is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

NVD description

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.

References

nvd.nist.gov/vuln/detail/CVE-2018-7576 · ADVISORY
tensorflow/tensorflow commit c484315 · WEB
GitHub Advisory GHSA-jfq2-rj7f-9gvf · ADVISORY
pypa/advisory-database · WEB
pypa/advisory-database · WEB
pypa/advisory-database · WEB
tensorflow/tensorflow · PACKAGE
tensorflow/tensorflow · WEB

More vulnerabilities in tensorflow

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free