CVE-2018-7577

HIGH

Google Snappy 1.1.4 - Memory Corruption via Memcpy Parameter Overlap

Title source: llm

Description

Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_confirm

https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-005.md

Scores

CVSS v3 8.1

EPSS 0.0043

EPSS Percentile 34.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Details

CWE

CWE-20

Status published

Products (4)

google/snappy 1.1.4

google/tensorflow < 1.7.1

pypi/tensorflow 1.1.0 - 1.7.1PyPI

pypi/tensorflow-gpu 1.1.0 - 1.7.1PyPI

Published Apr 24, 2019

Tracked Since Feb 18, 2026