search

MaurizioFD / RecSys_Course_AT_PoliMi

⚠️ [ARCHIVED] This version has been archived as of october 2024 and will not be updated anymore, please refer to the README for a link to the new version. This is the official repository for the Recommender Systems course at Politecnico di Milano.
GNU Affero General Public License v3.0
359 stars 150 forks source link

Bump tensorflow from 2.6.0 to 2.6.3 #11

Closed dependabot[bot] closed 2 years ago

dependabot[bot] commented 2 years ago

Bumps tensorflow from 2.6.0 to 2.6.3.

Release notes

Sourced from tensorflow's releases.

TensorFlow 2.6.3

Release 2.6.3

This releases introduces several vulnerability fixes:

  • Fixes a floating point division by 0 when executing convolution operators (CVE-2022-21725)
  • Fixes a heap OOB read in shape inference for ReverseSequence (CVE-2022-21728)
  • Fixes a heap OOB access in Dequantize (CVE-2022-21726)
  • Fixes an integer overflow in shape inference for Dequantize (CVE-2022-21727)
  • Fixes a heap OOB access in FractionalAvgPoolGrad (CVE-2022-21730)
  • Fixes an overflow and divide by zero in UnravelIndex (CVE-2022-21729)
  • Fixes a type confusion in shape inference for ConcatV2 (CVE-2022-21731)
  • Fixes an OOM in ThreadPoolHandle (CVE-2022-21732)
  • Fixes an OOM due to integer overflow in StringNGrams (CVE-2022-21733)
  • Fixes more issues caused by incomplete validation in boosted trees code (CVE-2021-41208)
  • Fixes an integer overflows in most sparse component-wise ops (CVE-2022-23567)
  • Fixes an integer overflows in AddManySparseToTensorsMap (CVE-2022-23568)
  • Fixes a number of CHECK-failures in MapStage (CVE-2022-21734)
  • Fixes a division by zero in FractionalMaxPool (CVE-2022-21735)
  • Fixes a number of CHECK-fails when building invalid/overflowing tensor shapes (CVE-2022-23569)
  • Fixes an undefined behavior in SparseTensorSliceDataset (CVE-2022-21736)
  • Fixes an assertion failure based denial of service via faulty bin count operations (CVE-2022-21737)
  • Fixes a reference binding to null pointer in QuantizedMaxPool (CVE-2022-21739)
  • Fixes an integer overflow leading to crash in SparseCountSparseOutput (CVE-2022-21738)
  • Fixes a heap overflow in SparseCountSparseOutput (CVE-2022-21740)
  • Fixes an FPE in BiasAndClamp in TFLite (CVE-2022-23557)
  • Fixes an FPE in depthwise convolutions in TFLite (CVE-2022-21741)
  • Fixes an integer overflow in TFLite array creation (CVE-2022-23558)
  • Fixes an integer overflow in TFLite (CVE-2022-23559)
  • Fixes a dangerous OOB write in TFLite (CVE-2022-23561)
  • Fixes a vulnerability leading to read and write outside of bounds in TFLite (CVE-2022-23560)
  • Fixes a set of vulnerabilities caused by using insecure temporary files (CVE-2022-23563)
  • Fixes an integer overflow in Range resulting in undefined behavior and OOM (CVE-2022-23562)
  • Fixes a vulnerability where missing validation causes tf.sparse.split to crash when axis is a tuple (CVE-2021-41206)
  • Fixes a CHECK-fail when decoding resource handles from proto (CVE-2022-23564)
  • Fixes a CHECK-fail with repeated AttrDef (CVE-2022-23565)
  • Fixes a heap OOB write in Grappler (CVE-2022-23566)
  • Fixes a CHECK-fail when decoding invalid tensors from proto (CVE-2022-23571)
  • Fixes a null-dereference when specializing tensor type (CVE-2022-23570)
  • Fixes a crash when type cannot be specialized (CVE-2022-23572)
  • Fixes a heap OOB read/write in SpecializeType (CVE-2022-23574)
  • Fixes an unitialized variable access in AssignOp (CVE-2022-23573)
  • Fixes an integer overflow in OpLevelCostEstimator::CalculateTensorSize (CVE-2022-23575)
  • Fixes an integer overflow in OpLevelCostEstimator::CalculateOutputSize (CVE-2022-23576)
  • Fixes a null dereference in GetInitOp (CVE-2022-23577)
  • Fixes a memory leak when a graph node is invalid (CVE-2022-23578)
  • Fixes an abort caused by allocating a vector that is too large (CVE-2022-23580)
  • Fixes multiple CHECK-failures during Grappler's IsSimplifiableReshape (CVE-2022-23581)
  • Fixes multiple CHECK-failures during Grappler's SafeToRemoveIdentity (CVE-2022-23579)
  • Fixes multiple CHECK-failures in TensorByteSize (CVE-2022-23582)

... (truncated)

Changelog

Sourced from tensorflow's changelog.

Release 2.6.3

This releases introduces several vulnerability fixes:

  • Fixes a floating point division by 0 when executing convolution operators (CVE-2022-21725)
  • Fixes a heap OOB read in shape inference for ReverseSequence (CVE-2022-21728)
  • Fixes a heap OOB access in Dequantize (CVE-2022-21726)
  • Fixes an integer overflow in shape inference for Dequantize (CVE-2022-21727)
  • Fixes a heap OOB access in FractionalAvgPoolGrad (CVE-2022-21730)
  • Fixes an overflow and divide by zero in UnravelIndex (CVE-2022-21729)
  • Fixes a type confusion in shape inference for ConcatV2 (CVE-2022-21731)
  • Fixes an OOM in ThreadPoolHandle (CVE-2022-21732)
  • Fixes an OOM due to integer overflow in StringNGrams (CVE-2022-21733)
  • Fixes more issues caused by incomplete validation in boosted trees code (CVE-2021-41208)
  • Fixes an integer overflows in most sparse component-wise ops (CVE-2022-23567)
  • Fixes an integer overflows in AddManySparseToTensorsMap (CVE-2022-23568)
  • Fixes a number of CHECK-failures in MapStage (CVE-2022-21734)
  • Fixes a division by zero in FractionalMaxPool (CVE-2022-21735)
  • Fixes a number of CHECK-fails when building invalid/overflowing tensor shapes (CVE-2022-23569)
  • Fixes an undefined behavior in SparseTensorSliceDataset (CVE-2022-21736)
  • Fixes an assertion failure based denial of service via faulty bin count operations (CVE-2022-21737)
  • Fixes a reference binding to null pointer in QuantizedMaxPool (CVE-2022-21739)
  • Fixes an integer overflow leading to crash in SparseCountSparseOutput (CVE-2022-21738)
  • Fixes a heap overflow in SparseCountSparseOutput (CVE-2022-21740)
  • Fixes an FPE in BiasAndClamp in TFLite (CVE-2022-23557)
  • Fixes an FPE in depthwise convolutions in TFLite (CVE-2022-21741)

... (truncated)

Commits
  • 92a6bb0 Merge pull request #54204 from tensorflow/disable-flaky-tests-on-r2.6
  • 3dc94ed Merge pull request #54203 from tensorflow/fix-sanity-on-r2.6
  • 52f4b51 Disable flaky test
  • ad069c0 Reorder tags to fix buildifier linting
  • 1db0b90 Merge pull request #54200 from tensorflow/cherrypick-510ae18200d0a4fad797c0bf...
  • dcbbb77 Set Env Variable to override Setuptools new behavior
  • fd16fa9 Merge pull request #54174 from tensorflow-jenkins/relnotes-2.6.3-32160
  • bc97b92 Update RELEASE.md
  • 1e6335b Merge pull request #54184 from tensorflow/cherrypick-d437dec4d549fc30f9b85c75...
  • 083c3c6 Update third_party/icu/workspace.bzl
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/MaurizioFD/RecSys_Course_AT_PoliMi/network/alerts).
dependabot[bot] commented 2 years ago

Superseded by #14.