{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39647784-957d-5f30-817c-e498724a03a1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "version": "9.4.0.post6+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9e4fdb37-1603-5287-9ae7-7aa4f21f5123", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:5920d9ee-feac-5c3e-b19f-4a59d35f02e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:18e26031-a8ba-5be0-b1c4-3fd111e2531d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:7216f37c-f042-56ee-95b0-cd78dbcfa566", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:244fc98b-5bd9-5d68-9d3c-2fdc7a121255", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:bb295591-1835-581d-871a-6242c37917f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:c1de3ecd-8b4f-5a66-a29f-3077c7904c4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:7436d5cc-bc98-56c6-bb67-56c1d8e50ece", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:d6f73124-d01b-5ef0-bebe-f10a6cb2e643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:dd7d2651-173b-5138-b5e8-96e9fc7ed187", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:394796b4-1506-5088-b49f-f8d950854116", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:ac6943c9-052a-5b46-b7c8-9da279e45cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:b992786d-31f7-5f63-b3bc-5856b40af69d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f902b58b-bca3-55d0-8862-e7348b358087", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:22596a8c-c6b9-57eb-9836-7751c4682421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:ed4d5f37-8ce3-5d14-bb54-038e081dba6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:d1a356eb-d9ff-530d-b88a-630bb4c8838e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:540b1bcb-2cb7-501f-aaff-c4bac5869b1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:45e0b85e-01eb-5e45-9501-cf102970f293", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:a5c07feb-7272-5b4f-97a7-c11804797f15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9ab38584-2d09-51e8-b005-bd9da9f834bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:ab1edbe9-4b01-5b46-9135-14910e1a2603", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f320d2f0-d2c5-58f2-9b73-159c188f1b46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:25a405e7-c34e-5e2b-b57d-33661031d334", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:1cdfa408-d255-58c0-b84a-489bfdd0e829", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9e8f143c-9953-5898-9c3a-23fd2879aaa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:68e6e1ff-2b0a-5846-ba10-7065381972cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:176ca43a-5295-5ad5-8655-fce9788a7c22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f21018ff-acf9-5a3c-8797-82ddc98a0d7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:306855b1-1e07-5249-9c69-8444309f18f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:c2b86edf-287c-5f96-8b22-925c1ac673dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f4150d5f-7e33-52d3-a381-4bb8a6ae12a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42310 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6e702d56-e93b-5a67-bf78-36a560052be4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:082ddba0-ddae-5503-8a9c-f13265a037cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:e2986de8-eef0-5086-be2b-cee26a4ac899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:47d473a1-f189-5e92-9d8b-769d815131e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:26c07cb0-414f-5b39-a99f-e8d702ceea8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:e0fc6688-7b3e-53d6-b6d3-ac0c8abeb4f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:80e67586-0899-5665-ae42-5eae200ce5d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59197 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:0b9a7296-4572-5d2b-bedb-f3cfc306f6f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:47077426-dbac-55a1-8a38-194fc4759a3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59199 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:d25e3647-3c55-53f3-92d8-9c56973f73bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59200 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:2db3f5b7-e8fc-5482-8cf1-b58373394a4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6b6eda52-b1bb-5023-b98c-58aaabfdafe0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59205 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:b4748f3e-4cb7-5530-999a-280449e1b39c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:a52ee209-556b-5c9a-90e9-b70554a017ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6dc9dc0d-7e5a-5b99-820d-e4d4fec47bd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f4f2f33a-4e3e-5f7b-b892-cccacae32c70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9bee2252-6998-5af5-b2ce-886b1920b8f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:1db4a297-393a-5fb6-a694-05fda3424657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:73207f6b-d9b0-5455-b40b-e8299fc6cb9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f67dd57d-9cad-5e25-a24d-85802ab2a190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post6+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:ddb4f178-bbd1-51b6-9ad6-fca1f206ce4c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post6+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } ] }