{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2af907ee-8cb6-5647-a7e5-10d1565016bd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "version": "9.4.0.post9+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.4.0", "type": "library", "version": "9.4.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4dd41140-f933-5995-bfab-18694c6a4773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:eff19950-eb38-5626-b001-605019b3f8b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:8cd2a24d-36ce-5efe-8259-54e14143c4ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e78ffac1-6350-58a9-bfe4-ca1903b26caa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:1f1709ed-1661-550d-b6ae-449a485ab708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:646dedef-0452-574b-96af-641c9808f4fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:366f2772-b6b1-5802-901d-9423bda5b191", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:f719ca0f-cce5-59b4-ba96-1b4e2f3aa970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:9f4d67e6-96d5-5715-a8ea-c3528b49a677", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:47329cc3-739c-536c-ae72-888bc246ac4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:6766c3b9-323a-58cd-aff4-62019742fccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4fc10322-af9f-58c6-a3d2-27f46ce924a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:3111bdcd-ba8e-562b-8364-f03a485467ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4c8cab3e-c27a-5995-81c0-5dccad9d572a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:6d7cfc07-0813-55e9-ba6d-e9f99f52885f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b6fd2486-bf94-5cb0-bf1b-cbb58b4f70ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:c73ca52c-bcc5-5803-ba2f-268db9841d18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:60a13a2e-d416-5d08-8b9f-017feca419b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2df3241d-abb1-5f2b-8c38-050a09021f72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:405056fe-6728-53dc-b1a0-59a1f6c3be44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "code_not_present" } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d717c809-ab03-54bd-9eae-2562626a36e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d2dbafb5-f81f-5fe0-a4d0-a1e63028881a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:f73b6c59-9d68-542d-b983-fabcdfdf5674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:b261025a-83d7-5f5f-9473-e86efa2d9f62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:abc29b2d-c0ca-5f39-96f9-0d925eaed556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:210a0426-d100-5f2a-aaf8-296accdacbc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:16450640-a1f4-51de-b40a-b7ed54329be5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2c1a498c-eebb-5279-b16d-5123e31f012a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e5421b60-b204-532c-9234-b2a903b3649f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:82a7167f-9611-5ab5-89f0-5b67af546ec9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:ae57899a-f90f-59e9-9e4d-aef4a14ff050", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:a7977ee2-23dd-5f53-8f78-0dea2ef88b8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4672c04b-f8ab-55d6-b952-8646f3884392", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:4e039fbf-ab0b-5fcd-8742-c1430899141a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:8225e895-b12f-578f-b11f-329fb752d0ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:39a81211-5bb0-5958-884e-8d24274d6ab8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:998c2fce-33de-5c55-9760-93143eb436dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:a5d9ca38-ae0d-5920-9daa-f68f0c8f59b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:e89b07c6-4c80-594b-86ed-bc8fbdb03358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:04974da9-2181-509b-aab0-b3d7b690ec29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:00552ae9-380b-5769-b8d5-f5723e4f1c4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:7b6d6123-f911-5e36-9ea9-7bd45f3bf0e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:03f976e3-a92f-50f3-9c99-5dee32958b5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:38f7189b-74a7-5194-baf1-3f656d3d4b2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:edf2ccaf-2a5f-5bbc-bbed-673cd756a462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:77753dae-7869-5697-91c5-a0d7e51474aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:ed32424d-5d75-5faa-a49e-2d3c57081f95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:2e8d47f4-7968-5fa3-930e-4e84a82c0093", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:bce29020-87ff-5c50-8991-86e58c20cfdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:389eb588-ff2f-5307-b8cb-974e6cae5519", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:3b69129a-7069-5fff-b42d-7d4697347e59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d1e7708f-eecc-5f60-9162-645fbcd7ad0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.4.0.post9+tuxcare of pillow." } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ], "bom-ref": "urn:uuid:d31cbbb1-12d1-566f-b66d-4a6d42b26bcd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post9+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } ] }