{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4a7a690d-6078-582b-bd63-b9f14fef8f1b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "version": "9.4.0.post7+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c395cfdf-5e2f-5096-8f9c-5c201946518a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:1a695385-c30e-5b50-b045-e648bfb579d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:fb557667-a091-584e-91c2-2d7478410eea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:13852986-757b-5ede-853c-f75757b72446", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:26031237-ba60-5324-bb15-ff256349476f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:777cf13d-9fbb-5973-b6b1-566971519a32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:8e8edfd9-2246-5c20-a94a-ea6c0c79586e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:5e03af2c-0e6c-5d05-92a7-17e68960b5f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:6ac6bb75-7d13-55e0-9f61-e66dc1ecf252", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f6b516b5-3362-5f92-9bee-b6d28e1a98ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ac6a3b08-d317-524d-9dd3-a58b8e4c18ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:72868b7a-069c-527b-9285-c4873035be8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0c727f2f-07c0-5a3c-81b1-48a63cda6d7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:81afa266-d701-59c6-a61f-eb44775acc4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:61b0cae4-2d85-5cb1-9aea-7c04f1276448", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:23cc1b39-0940-569a-a0d0-710271e443a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4a93f781-8b0b-5bc4-9ecd-4d5aa006c512", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b815de03-7208-5187-b072-35f2511e27b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4694df65-6e51-549b-b444-32b5632744ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:d2f99fb1-97a9-55e9-ae28-889193ca95c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:641b7840-3356-5982-81de-0e3047e86eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:bec3b990-9691-548d-ab19-754dbe0cb996", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:049602b5-6332-5d28-86ca-7285d54a8983", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ddff57c7-1865-5378-a7c8-210889592c44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:eb2a936e-3d5b-5d97-a62f-e3e6a746fe08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b8c871c1-232f-5777-8df1-602bf5da6e48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:8763f770-7891-57c8-b603-a4cbe1299a52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0295da81-6a29-5ecd-98bd-ff31ec5c8551", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f655a37c-cf7e-563b-a7d2-3971f98b6602", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:1a2d3158-9103-5729-8610-1ad5da8eeb45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:2716c4e7-f17e-5667-af41-db76eb6e5f74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:f0b8d06c-d79d-53ca-8a91-2640adf7cfdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:0639fdc6-f49e-5032-975a-cec71b7dc0b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ef1977de-7c09-575c-95d0-7126e813b4d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b461f98b-01fd-54a6-8ab7-e3890d49dfab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:7d5099e9-0309-5217-8c8e-f08c6d879d8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:3108235e-7b75-5ae2-8664-a910ea6ebae3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:6dddddc0-3b24-5b3b-b7e6-bbf866a69303", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:3e1e4684-2ea8-55da-99dc-c130e5bb295c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59197 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:ae60f5b0-274d-5655-bed5-c36179147e1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:87832274-134e-5016-981d-c9fdf3efb081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59199 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:635b242a-ba9a-5175-b48e-b93d723ce835", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59200 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:c81ec394-2ec2-58a0-98ad-cb733ab565c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:44f5797f-73d5-5a2b-af6c-b35644621236", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59205 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:b9cef4d7-9418-580e-8d68-ae4bd61aff4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:cc8798c4-6867-5afb-a6bf-357f75ead656", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:653fc3fb-7471-5aaa-ae96-1ab0cbb5a242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:159af48c-2218-5c4d-82ee-deec2da056d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:02778143-7915-5a05-bc7b-83dd68cfff2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:84eed1a6-e9bf-54f5-972c-6c8577cafa81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:7dda1c2a-717a-5396-a164-532241cd19d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:04c3f8cb-2d54-56cb-8733-07d8d802e6b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post7+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ], "bom-ref": "urn:uuid:4c8fea82-2707-5f0a-ad7c-0fc72521ede8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post7+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } ] }