Critical · 9.8 CVE-2019-10844 EUVD-2019-0092GHSA-4q2w-rw7m-xqw6PYSEC-2019-107

Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10

Published Apr 4, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environment variable, which might be untrusted.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	nnabla	< 1.0.10	1.0.10	GHSA-4q2w-rw7m-xqw6
PyPI	nnabla	< 1.0.15	1.0.15	PYSEC-2019-107

References

https://github.com/sony/nnabla/issues/209