CVE-2023-38669
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
There is a use after free vulnerability in paddle.diagonal in PaddlePaddle before version 2.5.0, leading to a potentially exploitable condition.
Risk Assessment
Organizations may be exposed to attacks that could lead to unauthorized access or execution of malicious code.
Recommendation
It is recommended to update PaddlePaddle to version 2.5.0 or later to mitigate this vulnerability.
Other vulnerabilities in PaddlePaddle
See all- CVE-2023-38673Critical
PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.
- CVE-2023-38672Medium
There is an FPE vulnerability in paddle.trace in PaddlePaddle before version 2.5.0, which can lead to runtime crashes and denial of service.
- CVE-2023-38671High
Heap buffer overflow in paddle.trace in PaddlePaddle before version 2.5.0. This flaw can lead to denial of service, information disclosure, or more damage is possible.
- CVE-2023-38670Medium
A null pointer dereference in paddle.flip in PaddlePaddle before version 2.5.0 results in a runtime crash and denial of service.
Original NVD description (English source)
Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.