CVE-2023-38672
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
There is an FPE vulnerability in paddle.trace in PaddlePaddle before version 2.5.0, which can lead to runtime crashes and denial of service.
Risk Assessment
This vulnerability can cause application downtime, affecting the availability of services within the organization.
Recommendation
It is recommended to upgrade PaddlePaddle to version 2.5.0 or later to mitigate this vulnerability.
Other vulnerabilities in PaddlePaddle
See all- CVE-2023-38673Critical
PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.
- CVE-2023-38671High
Heap buffer overflow in paddle.trace in PaddlePaddle before version 2.5.0. This flaw can lead to denial of service, information disclosure, or more damage is possible.
- CVE-2023-38670Medium
A null pointer dereference in paddle.flip in PaddlePaddle before version 2.5.0 results in a runtime crash and denial of service.
- CVE-2023-38669High
There is a use after free vulnerability in paddle.diagonal in PaddlePaddle before version 2.5.0, leading to a potentially exploitable condition.
Original NVD description (English source)
FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS