{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cad4d6b4-81c0-5b1c-8148-9db6e698443c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "version": "9.4.0.post12+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:51696140-0350-5d33-93e6-18397a1a4d35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:ad67d3d6-40b6-5985-9225-4354db197550", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:ff545f4a-35d5-51d5-bd5e-bd68ca7f72ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:c6c43a49-d381-55df-ac82-ac78422d17a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:94f7ba4b-98a6-5035-a689-4aac5de72915", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:ae8ae94e-a1b4-5f35-b7b7-a93203fc451d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:00799dbd-ded1-5cd8-8266-46e1a5bb9384", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:6793bd02-be28-5b10-bd75-af168d81b875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:4969820d-c962-546d-a559-a7e4a7f0cf51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:1a753772-1f6f-5c57-b4aa-5b531f49c445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:42b5eb15-de86-55fb-8b32-1551013bd8c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:0c8b4487-d902-524b-bdac-2317a62f2ec7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:285f23e1-ea9b-5ca6-88cd-2ea8e817d7ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:a44e01b6-eb75-5543-be67-6f1289d20d67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:48d62e24-fb6b-5ed6-b253-9e68a830956b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:105a77dd-d42c-5c92-b26d-ab61c7f5349a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:c43d0a4a-ccaf-5b98-91fc-8474508e4950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:15465b5c-2703-5ee7-bf16-80744ff23b5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:53fbb81e-01b7-5a71-baee-ed28c6b1ff6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:25e44187-95e6-5f11-9b61-4ad3a15aa372", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:ab5f63da-84ad-5241-8cfa-4f8b2c2e7ebe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:58d8aa3c-a4cf-5174-b05a-f87212d8fc07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:a9ac95f3-ad9d-5bf2-a59e-19fdeb6ede14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:efbbd4b3-597d-5842-b49d-2bedec1af059", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:1055aa20-2657-53f3-ae39-185efbf17cd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:e0256e35-2b1c-55fb-8411-d8f81643ccee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:5da97113-0a8c-5a85-a0da-cbe87daf6407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:deedec72-f6ab-5cc3-9d16-522100be07b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:62138566-af71-5360-853e-22cd2a82a2c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:fd655252-b402-5b1a-a444-00b0bcd6859b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:bf39ee66-1418-5ec2-9224-4b9a0811a650", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:a5c805e4-81c3-5863-abcd-928575c8253c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:8a3e5908-edf9-59fb-9473-307dbb52a709", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:e1f08915-bc68-5549-8144-880c8fc8ac3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:7ad8509a-8854-59c1-a664-2d9f47837be4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:b44658ec-bf36-5132-8dee-455d8030f483", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:3d7d5d91-a6fb-543b-9d59-320f7fc58980", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:b594966f-d7d9-5c27-a6b2-463d2e7dc03f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:f5087a35-4a95-50da-9b83-386ad4d0d4f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:f90e6629-e576-5288-91b7-c023ce547430", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:fdbfe434-c2f9-586f-bd81-f5a071829c91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:812d407d-6e26-5edf-be0e-b9938d071c08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:e1e3a8d1-e6a4-536e-8b4f-0657b123f1b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:389381fb-dc2a-587a-81cb-b50a25fdc4fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:1f794620-4b1d-5184-888e-d43fb89750d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:120c805b-2722-5e43-b6b4-b9e0455ac614", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:5644c39c-c60f-5e3a-a425-20da446aa59f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:347ec437-4b80-5850-a26d-006333093bc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:b03df148-b3ce-5c7d-bb43-d0be7f01ace0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:e69e43d7-59c8-55e5-b763-00e4c6c10133", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:8810ff4a-706d-5f72-a7bf-08c917a942c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:b7e00b6d-b7eb-5d92-b862-d8030d22d8d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post12+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ], "bom-ref": "urn:uuid:92e51987-9423-59cd-a90c-4511556cb593", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post12+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } ] }