paddlepaddle vulnerabilities

Recent CVEs affecting paddlepaddle products. 24 tracked.

paddlepaddle has 24 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 19. Most recent: 2024-03-23. Highest priority: CVE-2024-0917 (score 63/100).

• CVE-2024-1603 HIGH 7.5 DOWNGRADE paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.
• CVE-2024-0917 CRITICAL 9.8 DOWNGRADE remote code execution in paddlepaddle/paddle 2.6.0
• CVE-2024-0818 CRITICAL 9.1 UPGRADE Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6
• CVE-2024-0817 HIGH 7.8 DOWNGRADE Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0
• CVE-2024-0815 HIGH 8.8 DOWNGRADE Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0
• CVE-2024-0521 HIGH 7.8 MITIGATE Code Injection in paddlepaddle/paddle
• CVE-2023-52314 CRITICAL 9.6 UPGRADE PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare
• CVE-2023-52313 MEDIUM 4.7 UPGRADE FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0
• CVE-2023-52312 MEDIUM 4.7 UPGRADE Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0
• CVE-2023-52311 CRITICAL 9.6 UPGRADE PaddlePaddle before 2.6.0 has a command injection in _wget_download
• CVE-2023-52310 CRITICAL 9.6 UPGRADE PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval
• CVE-2023-52309 HIGH 8.2 UPGRADE Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0
• CVE-2023-52308 MEDIUM 4.7 UPGRADE FPE in paddle.amin in PaddlePaddle before 2.6.0
• CVE-2023-52307 HIGH 8.2 UPGRADE Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0
• CVE-2023-52306 MEDIUM 4.7 UPGRADE FPE in paddle.lerp in PaddlePaddle before 2.6.0
• CVE-2023-52305 MEDIUM 4.7 UPGRADE FPE in paddle.topk in PaddlePaddle before 2.6.0
• CVE-2023-52304 HIGH 8.2 UPGRADE Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0
• CVE-2023-52303 MEDIUM 4.7 UPGRADE Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0
• CVE-2023-52302 MEDIUM 4.7 UPGRADE Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0
• CVE-2023-38678 MEDIUM 4.7 UPGRADE OOB access in paddle.mode in PaddlePaddle before 2.6.0
• CVE-2023-38677 MEDIUM 4.7 UPGRADE FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0
• CVE-2023-38676 MEDIUM 4.7 UPGRADE Nullptr in paddle.dot in PaddlePaddle before 2.6.0
• CVE-2023-38675 MEDIUM 4.7 UPGRADE FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0
• CVE-2023-38674 MEDIUM 4.7 UPGRADE FPE in paddle.nanmedian in PaddlePaddle before 2.6.0

FAQ

How do I fix paddlepaddle vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is paddlepaddle being exploited right now?

None of the tracked paddlepaddle CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which paddlepaddle CVE should I patch first?

CVE-2024-0917 currently ranks highest (63/100): remote code execution in paddlepaddle/paddle 2.6.0.

Products

• paddle
• paddlepaddle

RSS feed for paddlepaddle · ← Back to latest CVEs