Skip to content

Commit 03dd1dc

Browse files
sirutBuasaisirutBuasai
authored
Patch PT 2.5 DLC (#4657)
1 parent 351c7f9 commit 03dd1dc

File tree

6 files changed

+134
-2
lines changed

6 files changed

+134
-2
lines changed

‎pytorch/inference/docker/2.5/py3/Dockerfile.ec2.cpu.os_scan_allowlist.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"libfreetype6": [
3+
{
4+
"description": "An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.",
5+
"vulnerability_id": "CVE-2025-27363",
6+
"name": "CVE-2025-27363",
7+
"package_name": "libfreetype6",
8+
"package_details": {
9+
"file_path": null,
10+
"name": "libfreetype6",
11+
"package_manager": "OS",
12+
"version": "2.11.1+dfsg",
13+
"release": "1ubuntu0.2"
14+
},
15+
"remediation": {
16+
"recommendation": {
17+
"text": "None Provided"
18+
}
19+
},
20+
"cvss_v3_score": 8.1,
21+
"cvss_v30_score": 0.0,
22+
"cvss_v31_score": 8.1,
23+
"cvss_v2_score": 0.0,
24+
"cvss_v3_severity": "HIGH",
25+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-27363.html",
26+
"source": "UBUNTU_CVE",
27+
"severity": "HIGH",
28+
"status": "ACTIVE",
29+
"title": "CVE-2025-27363 - libfreetype6",
30+
"reason_to_ignore": "N/A"
31+
}
32+
]
33+
}

‎pytorch/inference/docker/2.5/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"libfreetype6": [
3+
{
4+
"description": "An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.",
5+
"vulnerability_id": "CVE-2025-27363",
6+
"name": "CVE-2025-27363",
7+
"package_name": "libfreetype6",
8+
"package_details": {
9+
"file_path": null,
10+
"name": "libfreetype6",
11+
"package_manager": "OS",
12+
"version": "2.11.1+dfsg",
13+
"release": "1ubuntu0.2"
14+
},
15+
"remediation": {
16+
"recommendation": {
17+
"text": "None Provided"
18+
}
19+
},
20+
"cvss_v3_score": 8.1,
21+
"cvss_v30_score": 0.0,
22+
"cvss_v31_score": 8.1,
23+
"cvss_v2_score": 0.0,
24+
"cvss_v3_severity": "HIGH",
25+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-27363.html",
26+
"source": "UBUNTU_CVE",
27+
"severity": "HIGH",
28+
"status": "ACTIVE",
29+
"title": "CVE-2025-27363 - libfreetype6",
30+
"reason_to_ignore": "N/A"
31+
}
32+
]
33+
}

‎pytorch/inference/docker/2.5/py3/cu124/Dockerfile.ec2.gpu.os_scan_allowlist.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"libfreetype6": [
3+
{
4+
"description": "An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.",
5+
"vulnerability_id": "CVE-2025-27363",
6+
"name": "CVE-2025-27363",
7+
"package_name": "libfreetype6",
8+
"package_details": {
9+
"file_path": null,
10+
"name": "libfreetype6",
11+
"package_manager": "OS",
12+
"version": "2.11.1+dfsg",
13+
"release": "1ubuntu0.2"
14+
},
15+
"remediation": {
16+
"recommendation": {
17+
"text": "None Provided"
18+
}
19+
},
20+
"cvss_v3_score": 8.1,
21+
"cvss_v30_score": 0.0,
22+
"cvss_v31_score": 8.1,
23+
"cvss_v2_score": 0.0,
24+
"cvss_v3_severity": "HIGH",
25+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-27363.html",
26+
"source": "UBUNTU_CVE",
27+
"severity": "HIGH",
28+
"status": "ACTIVE",
29+
"title": "CVE-2025-27363 - libfreetype6",
30+
"reason_to_ignore": "N/A"
31+
}
32+
]
33+
}

‎pytorch/inference/docker/2.5/py3/cu124/Dockerfile.sagemaker.gpu.os_scan_allowlist.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"libfreetype6": [
3+
{
4+
"description": "An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.",
5+
"vulnerability_id": "CVE-2025-27363",
6+
"name": "CVE-2025-27363",
7+
"package_name": "libfreetype6",
8+
"package_details": {
9+
"file_path": null,
10+
"name": "libfreetype6",
11+
"package_manager": "OS",
12+
"version": "2.11.1+dfsg",
13+
"release": "1ubuntu0.2"
14+
},
15+
"remediation": {
16+
"recommendation": {
17+
"text": "None Provided"
18+
}
19+
},
20+
"cvss_v3_score": 8.1,
21+
"cvss_v30_score": 0.0,
22+
"cvss_v31_score": 8.1,
23+
"cvss_v2_score": 0.0,
24+
"cvss_v3_severity": "HIGH",
25+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-27363.html",
26+
"source": "UBUNTU_CVE",
27+
"severity": "HIGH",
28+
"status": "ACTIVE",
29+
"title": "CVE-2025-27363 - libfreetype6",
30+
"reason_to_ignore": "N/A"
31+
}
32+
]
33+
}

‎pytorch/training/docker/2.5/py3/Dockerfile.sagemaker.cpu.core_packages.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"accelerate": {
3-
"version_specifier": "==1.5.2",
3+
"version_specifier": "==1.5.1",
44
"skip": "True"
55
},
66
"fastai": {

‎pytorch/training/docker/2.5/py3/cu124/Dockerfile.sagemaker.gpu.core_packages.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"accelerate": {
3-
"version_specifier": "==1.5.2",
3+
"version_specifier": "==1.5.1",
44
"skip": "True"
55
},
66
"fastai": {

0 commit comments

Comments
 (0)