Dengyinlin

**Name of the Vulnerable Software and Affected Versions** TensorFlow versions prior to 2.11.1 **Description** A malicious invalid input can crash a TensorFlow model and be used to trigger a denial of service attack. This issue can be exploited using the `Convolution3DTranspose` function, a common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services, potentially allowing an attacker to trigger a denial of service attack on ML cloud services. An attacker must have privilege to provide input to a `Convolution3DTranspose` call. **Recommendations** For versions prior to 2.11.1, upgrade to version 2.11.1 to resolve the issue. As a temporary workaround, consider restricting the use of the `Convolution3DTranspose` function until a patch is applied. Avoid using the `Convolution3DTranspose` layer with untrusted input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TensorFlow versions prior to 2.12.0 and 2.11.1 **Description** The issue arises when the parameter `indices` for `DynamicStitch` does not match the shape of the parameter `data`, potentially triggering a stack OOB read. **Recommendations** For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider validating the shape of the `indices` and `data` parameters to ensure they match before using `DynamicStitch`.