Segfault in paddle.dot
CVE-2023-38676

4.7MEDIUM

Key Information:

Vendor: Paddlepaddle
Status: Paddlepaddle
Vendor: CVE Published:; 3 January 2024

🔔 Create Paddlepaddle Vulnerability Alert

What is CVE-2023-38676?

A null pointer dereference vulnerability exists in PaddlePaddle's paddle.dot function that can lead to a runtime crash, which may result in a denial of service. This issue affects versions prior to 2.6.0 and poses significant risks for applications relying on this functionality. Users are urged to upgrade to the latest version to mitigate potential impacts.

Affected Version(s)

PaddlePaddle 0 < 2.6.0

References

https://github.com/PaddlePaddle/Paddle/blob/develop/secur...

CVSS V3.1

Score:

4.7

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 3, 2024
Vulnerability Reserved
Jul 24, 2023

CVE-2023-38676 Data

JSON