{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:21f1677b-8b7d-5fd7-9ce6-fd310bf7cec2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "version": "9.4.0.post11+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:f04e0db2-2d3e-55cc-b58e-b4a2f086b9ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:a65d155e-67be-550a-bdd9-3cfd7e37eea9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:85e9f1d0-df12-5fb3-a99c-bf8fad31ea7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:b5329400-9fc1-5455-996e-69ff82bc71c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:086ae121-3cca-57a9-ad7a-b1f8ac89a532", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112390 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:549d0cd1-178c-5757-a5d2-7c01bb338598", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:33e915b8-5d5d-54ae-aa02-ab13ced724a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112392 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:f45ef159-71a8-5e96-8fd5-c6665f7533c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112393 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:ad7796df-b6c3-54d2-9f28-ecbe9b36f6c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:6dcfa2e5-ff9b-58a1-af51-ceb3461e66fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:630a7545-80f3-5a67-bc6b-12315ddf4335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:1e7d9a1f-ed56-5456-85d2-52c7dad6321f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:40066ff0-d66b-51f6-a0dd-54d2504c8d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112399 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:71793250-f306-5c66-a057-feeeb16b818b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:5c46185d-2e5b-55d8-89da-6f3cdfa0f306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:83fbf045-4200-5c09-9bd1-21fef0ae2c1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112402 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:ea11238f-8145-5b9e-ab84-acfe4dbcefe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:0aebdb26-306f-51d6-85fa-65f075831d34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:e30b6b0e-9573-5c9c-b566-ac995bf9b7a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112406 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:a72eb636-d0b0-5702-bed1-daf7a7e1f79d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:c176e385-bf6c-5f6b-a2e7-4e0599070b37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112892 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:a66fcfa7-17ce-5877-b807-4a121a6d06dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112894 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:feba41ff-c770-50ab-b836-35ef34279737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:0c0de8ec-7edc-5385-9847-9afec5fb9267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:d966274f-05aa-504b-8a0c-2c689ec130e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:9aa93090-7998-5900-aba8-ba9a4dc3d0cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:8f6dec9a-1883-5b19-929d-84414a5faab2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:45a2534e-c088-5991-b403-8c41f3f3c0db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-112900 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:c4a04527-036f-5df0-8b18-50a4e0b79a8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:6069927c-8588-5751-88fb-8e0eadf78ce7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:436818a1-9923-56dc-a644-ddf7a7bae2ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:91a31298-df2d-50fa-a375-3d0560cc84d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:9f5eb17e-2931-559b-8fc5-3150a19ad0a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:f1dfe179-633d-5485-a736-8373304035bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:d5fbc6c6-1f2d-5a30-9e2d-4c2d51f2bb52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:5f79f81a-ef6a-50a1-aa17-6ce74b6a9a61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:500e922a-98bc-5593-b8c2-d3e21ec6d0cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:33582689-0dbb-54fb-9436-8691fd862032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:5374727b-784c-589a-a23a-ea254947e745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:81071c4d-62f1-537f-99ba-2304dae8f5dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:750b8e07-a074-5947-8a3a-74125b727fcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:998f0960-dab4-5957-a4a8-bf4b4a614004", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:24fb6d7f-96aa-5fc7-8a55-9b49a85755e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:133acc3f-58b9-5891-9a66-b5b1181b472c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:5f627f4a-c90d-55a9-971f-3082c54c3c23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:01018df8-fbcd-5e71-80d6-ad6679ba9973", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:72076bdf-bcc6-57b0-95d8-eac2d217032d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:be541881-0c1a-5bd9-aef0-10b478382228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:68204985-0691-5dae-9dc4-30582737d6c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:bcc4a80a-84e0-5f64-a374-8e38c4d33723", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:4ef6f8a6-af3a-5fc4-a1c8-72ffca761806", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:2cb40643-0d15-5aa7-bf3c-61952e2844ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post11+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ], "bom-ref": "urn:uuid:4ebf3840-4121-5cb5-bb28-c33f3da69850", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post11+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } ] }