Nixpkgs Security Tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: python313Packages.rapidocr-onnxruntime

Found 3 matching suggestions

Untriaged
Permalink CVE-2023-29403
created 5 months, 2 weeks ago
Unsafe behavior in setuid/setgid binaries in runtime

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.

References

Affected products

runtime
  • <1.20.5
  • <1.19.10

Matching in nixpkgs

pkgs.onnxruntime

Cross-platform, high performance scoring engine for ML models

  • nixos-unstable -

pkgs.kata-runtime

Lightweight Virtual Machines like containers that provide the workload isolation and security of VMs

  • nixos-unstable -

pkgs.aws-lambda-rie

Locally test Lambda functions packaged as container images

  • nixos-unstable -

pkgs.dotnetCorePackages.runtime_9_0

Core functionality needed to create .NET Core projects, that is shared between Visual Studio and CLI (wrapper)

  • nixos-unstable -
Untriaged
Permalink CVE-2024-27319
created 5 months, 2 weeks ago
Versions of the package onnx before and including 1.15.0 are …

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.

References

Affected products

onnx
  • =<1.15.0

Matching in nixpkgs

pkgs.onnxruntime

Cross-platform, high performance scoring engine for ML models

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2024-27318
created 5 months, 2 weeks ago
Versions of the package onnx before and including 1.15.0 are …

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

References

Affected products

onnx
  • =<1.15.0

Matching in nixpkgs

pkgs.onnxruntime

Cross-platform, high performance scoring engine for ML models

  • nixos-unstable -

Package maintainers