[GH-ISSUE #883] vulnerability in cs249r_book project #1613

New Issue

GiteaMirror · 2026-04-11T07:58:32-05:00

GiteaMirror commented

2026-04-11 07:58:32 -05:00

Originally created by @ankitdn on GitHub (Jul 2, 2025).
Original GitHub issue: https://github.com/harvard-edge/cs249r_book/issues/883

While working on cs249r_book project, I discovered a critical vulnerability CVE-2025-48379 in the pillow package. The vulnerability is a heap buffer overflow in the DDS encoding logic, introduced in version 11.2.0. It can be triggered when processing large DDS images and may lead to crashes or remote code execution.

CVE Link
CVE Report

Originally created by @ankitdn on GitHub (Jul 2, 2025). Original GitHub issue: https://github.com/harvard-edge/cs249r_book/issues/883 While working on cs249r_book project, I discovered a critical vulnerability [CVE-2025-48379](https://vulert.com/vuln-db/CVE-2025-48379) in the pillow package. The vulnerability is a heap buffer overflow in the DDS encoding logic, introduced in version 11.2.0. It can be triggered when processing large DDS images and may lead to crashes or remote code execution. [CVE Link](https://vulert.com/vuln-db/CVE-2025-48379) [CVE Report](https://vulert.com/vuln-scan/list/c851e940-111c-4563-b854-2c8eecc7c733?sort_order=desc&sort_by=created_at)

GiteaMirror added the area: book label 2026-04-11 07:58:32 -05:00

GiteaMirror closed this issue

2026-04-11 07:58:33 -05:00

GiteaMirror referenced this issue

2026-05-03 01:29:22 -05:00

[PR #1618] [MERGED] fix(tinytorch): milestone 3 xor convergence and reporting (#1613, #1614) #9224

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/cs249r_book#1613