{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f67fd9c6-2be6-54f6-9f85-1f3c0c42b622", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "version": "9.4.0.post10+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:d8e2feef-558d-528d-abdd-a826af528476", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:353f4e4f-e04a-51d2-9385-2689e528619a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:b0170994-d14d-580d-99d5-7813235643bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f3851676-05bc-5caa-900c-6be0adfb65fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:370af219-ba43-57e4-9a0f-c5d507b91f27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:acc3a2e5-8ebe-5fdf-aee8-2cef43d7505b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:77ed7075-401d-55ac-9f25-70a5df424f97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:b15550f5-f984-5f75-9942-98acea1c70a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:43890758-dbab-5cfd-bd94-9e1b229fd1d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:5bab2290-6436-51b8-8cc3-8574c166418b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:fc34dd99-5d3c-57c2-8acd-f9b721c99767", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:dbf0cc32-4338-5dc3-aa65-bde80f3d4347", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f55f2943-9613-54ad-a683-d7d215f86d14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:20c94894-f9bc-57e0-92cd-66b3555b3e2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:58107df1-8e65-55c5-be32-51f27d756d83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:eb7be4e8-078b-51f5-add1-72905bf7a798", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:f9391390-01fa-5558-817e-208de382e1d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:84e073a3-5ba8-5eba-bd79-85dac7ab360c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:480e89e7-3bc1-541a-b348-aa103711deae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a3b065d7-4b95-5f76-a506-dd259973aee1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:8359da67-154b-5df9-a7ca-0175b7d69857", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:3aaf1301-0205-5bd4-87a2-5ecc87e9b189", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:d3ffcaa5-fc53-5131-8648-caddca5f3c5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:264b2ed9-4f6e-5f51-ab5b-ac8a9ae4707b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:6e2d6510-cbce-56fc-8f6d-254e641f90e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:5ba40816-b234-54aa-9c0d-f496da3d3de6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:11b90ad7-80d5-5dd7-8475-53c62d4f8ac9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:403d70d6-88b3-525e-b7ae-9cc38e415574", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:d8310752-c9bb-5143-9e80-d6feff4da704", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:ef130133-c232-5ddf-ad35-f981b7b8bbaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:6fd649a6-b893-5394-a8c5-f2f57aea1d5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:36310ef8-3824-5c16-91cc-0b7313f75b86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:6186a4fc-138c-5a49-862a-689907c6c170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:fd8a9345-afcb-5a9f-b9c4-dbd87e16c6f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:e733f687-303e-526e-b45b-880b4bf547cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:0c2f0bf0-7aaf-5a69-802b-fdf0e4b99de1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:a763b209-9cd6-556b-9a5e-e640d787141a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:4cc596d3-3bf2-5e91-8339-3f1536e7eaca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:0dbf9143-508b-57fc-9de7-f68a796e0e7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:8bb0817b-b1a0-5435-a659-d26683c6c474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:e5d784ab-39e4-5b47-9651-348331e18414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:486c5612-e406-5210-af00-35f860c10426", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:9c409462-fe85-5ee4-8bf2-25f120f91778", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:c47cc306-1099-510f-8619-84270097081b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:1b64b2f3-6985-51d3-817c-0eb4014618c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:2d476b49-6614-5d1c-a5c9-eba3df3f2e4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:657d4411-5db6-5174-a419-bb096ad9bc03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:9359c8d0-6e1d-5241-97ed-77272c5cb9a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:927c6289-603f-5bf5-b2e3-94e569db4d98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:0adcc982-d866-56ec-881e-3d38abcfe199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:5c0d7e69-be9d-5799-84cd-e5aa7dc6cc39", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:8e8f8a5f-bd06-594b-bc27-dbe021cec8e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post10+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ], "bom-ref": "urn:uuid:d5b61495-a11b-544f-b724-a9413a5e2564", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post10+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } ] }