{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:61c46094-f372-5190-8229-987cd5712425", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "version": "9.4.0.post8+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a3b312ef-c92f-5548-90b0-f9d2c962380a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2db33e64-1514-54f1-8605-3cb25d183da9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7a023249-ec5b-5478-aec7-dc5f98c80bfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d9035a69-f557-5707-801a-0dc51ebd95b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:504adf9d-6fce-5d73-b0c2-0ef2b96375b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:80cb6314-f232-5947-919d-c0e1ecefbae9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c38108ad-2190-5958-80f1-8d3a680abd8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e240f456-3833-5877-8d96-53cd2efbfd79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:09bd6c50-88ea-513d-85f5-a13eec92055f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:747d16a1-6c54-5ffd-80b0-eb69c5b781b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:3d140f7d-2452-5d17-885c-bd59f40c0cbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:977f5f1a-7c95-574f-b722-42f8e0deebf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:946b64bd-3348-57fa-8b54-86160b032644", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c95b7468-c1d7-53d5-8eec-d1aafb97dc0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a5fa9977-0dc4-5439-ab93-25c09b95fca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b9b0213e-1cf5-5e8b-ba79-a9cae5bd0bb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:22cf424f-d441-5178-a2b3-2ab8bbf7f0eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:5aaa1a57-d352-51ca-bbbe-bcdf7f90bb87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6d7e5e47-2622-55b4-8d46-e54e8b6fc6dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f193b2a5-b43b-5410-994b-42c32ae39c44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f8e694d6-b6a4-5fda-8b61-310cc7e4428a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:811afa1d-338b-578f-99d2-602f2e5d7059", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:9a54824e-d166-5f83-87ca-fc0bae45afdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d13a0151-fc53-5129-8150-9e1937014cd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:99e7c7d9-9b03-525e-9fe3-683c94cc8609", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:49e84a5e-8c9a-54a9-9771-fad8c1bc39b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:3587871c-d6b1-56c7-83f4-b1571d66ac0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ee419635-8979-5f44-b5d9-a0ea602b1fa7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:db5b8fbc-4fd8-5181-938e-dcf4aadf8b99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:420d9ad7-2099-5f4a-93dc-593568322448", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:02559b00-3ac0-573e-a7c5-4f661348bc25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42308 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1aecc7d9-d15e-5761-8e48-d44cb4022e5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7759f848-8782-5f29-bea3-f4e12ded7ecc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:354fb0ce-b344-57f6-aebe-c9055732c0d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:778cfc1f-1cf6-5af8-a6b9-a3de291598ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:04294597-d404-5611-86a6-8d95a0dbb556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:046bcb54-ca3e-5712-ad87-17d0bed2b8a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55380 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7e39d8e0-c8a3-5ca8-bfea-61143db7569b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:0d3b9f5d-6b0c-52c5-91b9-57417d18f75a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b7d3832f-eabe-5461-bf0c-3884ad9efc14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59198 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1fd34cff-b053-5321-9dd1-00e0c1ab2b30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:77f6dd5f-a575-55b7-a885-4366f0947116", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:78d39901-c2a5-5c31-9de9-6601dcd3ac7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59204 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:89003196-fba8-5cd9-9ae5-15cbbb250d33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:bff85565-834d-5746-9560-8c31b49f49d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7932ffb7-c894-5c4f-8402-52066d9d41ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8035ccf3-10cf-5fa4-a98c-69e91275367c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7641f043-dd6b-5f25-b22a-efc53f4bc169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:09cc2287-9399-50bd-8990-216dad47d986", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e0859213-543b-59d7-8e08-b42a7c989d74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:be5fe2c4-0405-55e6-abe2-3e5fa2b3a901", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8a080092-1ca1-5796-aaae-528a3ca6cceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post8+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f0ed45ee-c0ec-5e7c-9d09-c5cf0aa0c5e1", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post8+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } ] }