CVE-2023-25667: 
Python vulnerability analysis and mitigation

CVE-2023-25667 affects TensorFlow, an open source platform for machine learning. The vulnerability was discovered in versions prior to 2.12.0 and 2.11.1, where an integer overflow occurs when 2^31 <= num_frames * height * width * channels < 2^32, for example when processing a Full HD screencast of at least 346 frames. The issue was disclosed on March 24, 2023 (NVD, GitHub Advisory).

The vulnerability is caused by an integer overflow condition in the image processing functionality of TensorFlow. The issue specifically occurs when handling multiframe GIF images where the product of num_frames, height, width, and channels falls between 2^31 and 2^32. This condition can be triggered, for example, with a Full HD screencast containing at least 346 frames. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (NVD).

When exploited, this vulnerability can lead to a segmentation fault when attempting to open multiframe GIF files that meet the specific size conditions. This could potentially result in application crashes and denial of service (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.12.0 and 2.11.1. Users are advised to upgrade to these or later versions. The fix was implemented in GitHub commit 8dc723fcdd1a6127d6c970bd2ecb18b019a1a58d (GitHub Commit).