{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9f761ca3-34b8-5ab1-91c2-024fdba02f74", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "version": "9.5.0.post8+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@9.5.0", "type": "library", "version": "9.5.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22815", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1cde0eb8-c491-54a2-a5ef-5f3d766a2ce8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "code_not_present" } }, { "id": "CVE-2022-22816", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:13714577-df0b-5c4d-a3fc-2570c485d52e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "code_not_present" } }, { "id": "CVE-2022-22817", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:edb34485-4c3e-587b-a9a0-c60acff38dbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22817 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-24303", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:26a9a935-8005-5012-a2fe-2d7c522b0af7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-24303 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2022-45198", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:aa630c64-e275-5cdf-9805-bbc9b6c6fac5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-45198 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-44271", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:897aec3f-8c19-50e3-859a-e762c6afe80d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-4863", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:265e2736-5a48-5f30-81f8-acab6ca9d88d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2023-50447", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f3f5c65c-bf1b-5ed3-8c31-240afc9a24a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2024-28219", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:f9b3d589-baad-55a2-9b7c-7fe9e05fca02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2025-48379", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b2e634ab-415e-5dec-9ccb-ff9438ad678a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48379 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:0a04b857-2fd6-526f-b4a9-329ff40f646b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e95e9a39-62ba-5797-84f4-2ff7fb37de9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ec726dd8-ab75-5ba5-a176-38c27fb34c27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:024fa4ff-d896-5640-88b5-1631edd49766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:478accb7-16e7-5142-82b7-8ff1822f13cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:47b73842-2f3a-5b09-a4cf-fd1d8a1e8602", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:88d022c9-06e7-54f1-9b0e-a43c0f9c2740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ecb57766-30df-5bdc-9646-fa7b05ddca25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b9b86448-ab10-5815-bdc3-5bccf383b520", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8b1c22c8-c727-5943-9185-dc21cedd6bdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b9c6d1dc-a12e-5f73-b5a7-578004246cb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4f41b8bb-35e5-5ef4-bd8a-79bcbc8455d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d6db165d-487a-58ed-95b1-6026e114bef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:2ec759f0-7591-5cb6-90cf-961cc78aafb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b9c62ae9-94d6-5e73-8d72-acb54ce7b2e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112405", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:457add17-6400-5094-8e2a-3b57d7d7e3ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112405 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:5743402f-c5e7-587b-a605-d6af0bd7d4d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ec2b0335-405e-55f3-a665-5f95bdd3bfad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:9e8588f6-31bf-5707-9bf0-8a3e8750d038", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:33b2cc1b-80b8-59ff-abfc-662290484dd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:62031f76-5751-560d-a99d-9043a9c353cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6683b277-4767-58d4-934a-b738bd043218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:aadd1032-07d6-551a-ad57-39517538bfe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:feab9e85-580a-591e-9206-d227c061dde2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1703c338-ad6b-57d1-9160-423a6ae491e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8432c914-0d52-5bca-a5d5-d30dcf452962", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ad2f6608-d070-5f89-926c-04f75a5829d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8cbbcbb4-c777-5e7a-a7c2-fcfa33463e7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:dc477d76-b92a-57e0-8874-87f50d14cef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:e7096d85-890d-5b76-8724-de2f573c2068", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "code_not_present" } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:38ca43da-b937-5ddb-ae96-c58d901b8983", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25990 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:a1ce0b37-29c4-528c-9375-f816dffac3bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40192 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c4acbcff-4c53-55ab-9a2a-eee4034d6564", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c4849bfe-8dfb-533d-a6f7-be693675face", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7dbe0c96-a6a4-54d0-99c1-9fc58c2f7d56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8a8cc1c5-f42d-512b-bdd4-811227ab4bf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42311 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7a4abe81-7756-5ad2-b2d5-2c47ff51d9bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:33c26ee8-e52a-584a-947b-2b2f0f789f93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8851e8dd-6826-5531-850c-a8a0a9177200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:d1b36fd3-db07-575a-bc9c-5aa2e71e51fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4a20cfa4-10b4-5970-99ba-84c402fa9a44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:189aa0af-6197-5766-a3b7-09ae76814e85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:9700611d-7127-5ad0-96f5-d4186abb3658", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:8a1c7ed1-5b30-5b88-a8f8-7ea085d0838f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4680209a-9874-5394-9840-31e859a87abf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:566a05db-623d-5fb3-91bd-2fa32637f223", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:0e80596d-5d10-5f0f-9cb9-326c9a9863b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c464f508-bed6-50c7-a5f3-9dcd23daa056", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:1345abdd-2e23-5b9a-9f8e-8945633b25a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:bce3806d-8ea4-5e68-ada7-9a9ad11fad3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:4970a086-0fd2-55bb-b2bd-46a8aa084795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:c72ccd8c-f6a1-5150-bea1-a90f19310dfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:7e38942a-4664-5261-a26b-3f34a4d1d8dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:0d75e204-5a5a-5066-9eea-9dfd1870b0af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:b9616ae4-4dea-5e38-b39f-891fab1e444d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:0428e1b4-2044-571b-9e63-a3f72d3773c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:299defab-f9ba-5542-85cd-da8aeebbfee3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 9.5.0.post8+tuxcare of pillow." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:6ba264d5-23c4-5b23-8da1-29546d31934e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." } }, { "id": "GHSA-4fx9-vc88-q2xc", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:ae31f234-f3c8-5b6b-9506-9749641c0b0f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "code_not_present" } }, { "id": "GHSA-56pw-mpj4-fxww", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:23cb2d2b-ae37-5153-8675-511d8a98e37a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post8+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ], "bom-ref": "urn:uuid:17b5e0f0-a0ea-5bf9-bdf9-e04585436b40", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post8+tuxcare of pillow." } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } ] }