{"vulnerability": "CVE-2020-3565", "sightings": [{"uuid": "d15deab3-ab9a-4da4-b1aa-fe472c8e46d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35654", "type": "seen", "source": "https://t.me/cibsecurity/25168", "content": "\u203c CVE-2021-25289 \u203c\n\nAn issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-19T06:33:01.000000Z"}, {"uuid": "e1727537-06d6-4ce3-b5b4-b8748c580e45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35659", "type": "seen", "source": "https://t.me/cibsecurity/21276", "content": "\u203c CVE-2020-35659 \u203c\n\nThe DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-24T18:55:29.000000Z"}, {"uuid": "4c48d5ca-11d4-40cb-a08f-896da02f10e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35657", "type": "seen", "source": "https://t.me/cibsecurity/21212", "content": "\u203c CVE-2020-35657 \u203c\n\nJaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T07:54:00.000000Z"}, {"uuid": "404c1ad7-85fb-4aa1-8938-a7c200334765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35656", "type": "seen", "source": "https://t.me/cibsecurity/21211", "content": "\u203c CVE-2020-35656 \u203c\n\nJaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T07:53:59.000000Z"}, {"uuid": "7e23b98c-cf4e-4bb9-a3bf-1884aaf58b7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35658", "type": "seen", "source": "https://t.me/cibsecurity/21210", "content": "\u203c CVE-2020-35658 \u203c\n\nSpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T07:53:58.000000Z"}, {"uuid": "5c71f14f-ac69-42cc-9afe-df9b6d49ffbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35650", "type": "seen", "source": "https://t.me/cibsecurity/21232", "content": "\u203c CVE-2020-35650 \u203c\n\nMultiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgm_code_redeem POST Parameter in user-code-redemption.php, the ulgm_user_first POST Parameter in user-registration-form.php, the ulgm_user_last POST Parameter in user-registration-form.php, the ulgm_user_email POST Parameter in user-registration-form.php, the ulgm_code_registration POST Parameter in user-registration-form.php, the ulgm_terms_conditions POST Parameter in user-registration-form.php, the _ulgm_total_seats POST Parameter in frontend-uo_groups_buy_courses.php, the uncanny_group_signup_user_first POST Parameter in group-registration-form.php, the uncanny_group_signup_user_last POST Parameter in group-registration-form.php, the uncanny_group_signup_user_login POST Parameter in group-registration-form.php, the uncanny_group_signup_user_email POST Parameter in group-registration-form.php, the success-invited GET Parameter in frontend-uo_groups.php, the bulk-errors GET Parameter in frontend-uo_groups.php, or the message GET Parameter in frontend-uo_groups.php.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T19:25:31.000000Z"}, {"uuid": "baa9c815-7a46-489c-9f08-3ecbe1225351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3565", "type": "seen", "source": "https://t.me/cibsecurity/15503", "content": "\u203c CVE-2020-3565 \u203c\n\nA vulnerability in the TCP Intercept functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured Access Control Policies (including Geolocation) and Service Polices on an affected system. The vulnerability exists because TCP Intercept is invoked when the embryonic connection limit is reached, which can cause the underlying detection engine to process the packet incorrectly. An attacker could exploit this vulnerability by sending a crafted stream of traffic that matches a policy on which TCP Intercept is configured. A successful exploit could allow the attacker to match on an incorrect policy, which could allow the traffic to be forwarded when it should be dropped. In addition, the traffic could incorrectly be dropped.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-21T22:51:20.000000Z"}, {"uuid": "15bd4e70-0420-44bf-8889-3a7717e2d351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35653", "type": "seen", "source": "https://gist.github.com/skytk926/06ed8dea85486b4187e18ebeac768a83", "content": "#\n# The Python Imaging Library.\n# $Id$\n#\n# PCX file handling\n#\n# This format was originally used by ZSoft's popular PaintBrush\n# program for the IBM PC.  It is also supported by many MS-DOS and\n# Windows applications, including the Windows PaintBrush program in\n# Windows 3.\n#\n# history:\n# 1995-09-01 fl   Created\n# 1996-05-20 fl   Fixed RGB support\n# 1997-01-03 fl   Fixed 2-bit and 4-bit support\n# 1999-02-03 fl   Fixed 8-bit support (broken in 1.0b1)\n# 1999-02-07 fl   Added write support\n# 2002-06-09 fl   Made 2-bit and 4-bit support a bit more robust\n# 2002-07-30 fl   Seek from to current position, not beginning of file\n# 2003-06-03 fl   Extract DPI settings (info[\"dpi\"])\n#\n# Copyright (c) 1997-2003 by Secret Labs AB.\n# Copyright (c) 1995-2003 by Fredrik Lundh.\n#\n# See the README file for information on usage and redistribution.\n#\nfrom __future__ import annotations\n\nimport io\nimport logging\nfrom typing import IO\n\nfrom . import Image, ImageFile, ImagePalette\nfrom ._binary import i16le as i16\nfrom ._binary import o8\nfrom ._binary import o16le as o16\n\nlogger = logging.getLogger(__name__)\n\n\ndef _accept(prefix: bytes) -> bool:\n    return len(prefix) >= 2 and prefix[0] == 10 and prefix[1] in [0, 2, 3, 5]\n\n\n##\n# Image plugin for Paintbrush images.\n\n\nclass PcxImageFile(ImageFile.ImageFile):\n    format = \"PCX\"\n    format_description = \"Paintbrush\"\n\n    def _open(self) -> None:\n        # header\n        assert self.fp is not None\n\n        s = self.fp.read(68)\n        if not _accept(s):\n            msg = \"not a PCX file\"\n            raise SyntaxError(msg)\n\n        # image\n        bbox = i16(s, 4), i16(s, 6), i16(s, 8) + 1, i16(s, 10) + 1\n        if bbox[2] <= bbox[0] or bbox[3] <= bbox[1]:\n            msg = \"bad PCX image size\"\n            raise SyntaxError(msg)\n        logger.debug(\"BBox: %s %s %s %s\", *bbox)\n\n        offset = self.fp.tell() + 60\n\n        # format\n        version = s[1]\n        bits = s[3]\n        planes = s[65]\n        provided_stride = i16(s, 66)\n        logger.debug(\n            \"PCX version %s, bits %s, planes %s, stride %s\",\n            version,\n            bits,\n            planes,\n            provided_stride,\n        )\n\n        self.info[\"dpi\"] = i16(s, 12), i16(s, 14)\n\n        if bits == 1 and planes == 1:\n            mode = rawmode = \"1\"\n\n        elif bits == 1 and planes in (2, 4):\n            mode = \"P\"\n            rawmode = f\"P;{planes}L\"\n            self.palette = ImagePalette.raw(\"RGB\", s[16:64])\n\n        elif version == 5 and bits == 8 and planes == 1:\n            mode = rawmode = \"L\"\n            # FIXME: hey, this doesn't work with the incremental loader !!!\n            self.fp.seek(-769, io.SEEK_END)\n            s = self.fp.read(769)\n            if len(s) == 769 and s[0] == 12:\n                # check if the palette is linear grayscale\n                for i in range(256):\n                    if s[i * 3 + 1 : i * 3 + 4] != o8(i) * 3:\n                        mode = rawmode = \"P\"\n                        break\n                if mode == \"P\":\n                    self.palette = ImagePalette.raw(\"RGB\", s[1:])\n\n        elif version == 5 and bits == 8 and planes == 3:\n            mode = \"RGB\"\n            rawmode = \"RGB;L\"\n\n        else:\n            msg = \"unknown PCX mode\"\n            raise OSError(msg)\n\n        self._mode = mode\n        self._size = bbox[2] - bbox[0], bbox[3] - bbox[1]\n\n        # Don't trust the passed in stride.\n        # Calculate the approximate position for ourselves.\n        # CVE-2020-35653\n        stride = (self._size[0] * bits + 7) // 8\n\n        # While the specification states that this must be even,\n        # not all images follow this\n        if provided_stride != stride:\n            stride += stride % 2\n\n        bbox = (0, 0) + self.size\n        logger.debug(\"size: %sx%s\", *self.size)\n\n        self.tile = [ImageFile._Tile(\"pcx\", bbox, offset, (rawmode, planes * stride))]\n\n\n# --------------------------------------------------------------------\n# save PCX files\n\n\nSAVE = {\n    # mode: (version, bits, planes, raw mode)\n    \"1\": (2, 1, 1, \"1\"),\n    \"L\": (5, 8, 1, \"L\"),\n    \"P\": (5, 8, 1, \"P\"),\n    \"RGB\": (5, 8, 3, \"RGB;L\"),\n}\n\n\ndef _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None:\n    if im.width == 0 or im.height == 0:\n        msg = \"Cannot write empty image as PCX\"\n        raise ValueError(msg)\n\n    try:\n        version, bits, planes, rawmode = SAVE[im.mode]\n    except KeyError as e:\n        msg = f\"Cannot save {im.mode} images as PCX\"\n        raise ValueError(msg) from e\n\n    # bytes per plane\n    stride = (im.size[0] * bits + 7) // 8\n    # stride should be even\n    stride += stride % 2\n    # Stride needs to be kept in sync with the PcxEncode.c version.\n    # Ideally it should be passed in in the state, but the bytes value\n    # gets overwritten.\n\n    logger.debug(\n        \"PcxImagePlugin._save: xwidth: %d, bits: %d, stride: %d\",\n        im.size[0],\n        bits,\n        stride,\n    )\n\n    # under windows, we could determine the current screen size with\n    # \"Image.core.display_mode()[1]\", but I think that's overkill...\n\n    screen = im.size\n\n    dpi = 100, 100\n\n    # PCX header\n    fp.write(\n        o8(10)\n        + o8(version)\n        + o8(1)\n        + o8(bits)\n        + o16(0)\n        + o16(0)\n        + o16(im.size[0] - 1)\n        + o16(im.size[1] - 1)\n        + o16(dpi[0])\n        + o16(dpi[1])\n        + b\"\\0\" * 24\n        + b\"\\xff\" * 24\n        + b\"\\0\"\n        + o8(planes)\n        + o16(stride)\n        + o16(1)\n        + o16(screen[0])\n        + o16(screen[1])\n        + b\"\\0\" * 54\n    )\n\n    assert fp.tell() == 128\n\n    ImageFile._save(\n        im, fp, [ImageFile._Tile(\"pcx\", (0, 0) + im.size, 0, (rawmode, bits * planes))]\n    )\n\n    if im.mode == \"P\":\n        # colour palette\n        fp.write(o8(12))\n        palette = im.im.getpalette(\"RGB\", \"RGB\")\n        palette += b\"\\x00\" * (768 - len(palette))\n        fp.write(palette)  # 768 bytes\n    elif im.mode == \"L\":\n        # grayscale palette\n        fp.write(o8(12))\n        for i in range(256):\n            fp.write(o8(i) * 3)\n\n\n# --------------------------------------------------------------------\n# registry\n\n\nImage.register_open(PcxImageFile.format, PcxImageFile, _accept)\nImage.register_save(PcxImageFile.format, _save)\n\nImage.register_extension(PcxImageFile.format, \".pcx\")\n\nImage.register_mime(PcxImageFile.format, \"image/x-pcx\")\n\n\n{\n  \"$schema\": \"http://cyclonedx.org/schema/bom-1.7.schema.json\",\n  \"bomFormat\": \"CycloneDX\",\n  \"specVersion\": \"1.7\",\n  \"serialNumber\": \"urn:uuid:e11ef76f-c1f5-4768-929c-1cc6d6bab343\",\n  \"version\": 1,\n  \"metadata\": {\n    \"timestamp\": \"2026-07-01T09:47:40Z\",\n    \"lifecycles\": [\n      {\n        \"phase\": \"build\"\n      }\n    ],\n    \"tools\": {\n      \"components\": [\n        {\n          \"type\": \"application\",\n          \"name\": \"generate-sbom.py\",\n          \"group\": \"pillow\"\n        }\n      ]\n    },\n    \"component\": {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0\",\n      \"type\": \"library\",\n      \"name\": \"Pillow\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Python Imaging Library (fork)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0\",\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://python-pillow.github.io\"\n        },\n        {\n          \"type\": \"vcs\",\n          \"url\": \"https://github.com/python-pillow/Pillow\"\n        },\n        {\n          \"type\": \"documentation\",\n          \"url\": \"https://pillow.readthedocs.io\"\n        },\n        {\n          \"type\": \"security-contact\",\n          \"url\": \"https://github.com/python-pillow/Pillow/security/policy\"\n        }\n      ]\n    }\n  },\n  \"components\": [\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\",\n      \"type\": \"library\",\n      \"name\": \"PIL._avif\",\n      \"version\": \"12.3.0\",\n      \"description\": \"AVIF image format extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imaging\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Core image processing extension (decode, encode, map, display, outline, path, libImaging)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingcms\",\n      \"version\": \"12.3.0\",\n      \"description\": \"LittleCMS2 colour management extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingft\",\n      \"version\": \"12.3.0\",\n      \"description\": \"FreeType font rendering extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmath\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingmath\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Image math operations extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmath\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmorph\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingmorph\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Image morphology extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmorph\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingtk\",\n      \"type\": \"library\",\n      \"name\": \"PIL._imagingtk\",\n      \"version\": \"12.3.0\",\n      \"description\": \"Tk/Tcl display extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingtk\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\",\n      \"type\": \"library\",\n      \"name\": \"PIL._webp\",\n      \"version\": \"12.3.0\",\n      \"description\": \"WebP image format extension\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT-CMU\"\n          }\n        }\n      ],\n      \"purl\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\"\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#thirdparty/fribidi-shim\",\n      \"type\": \"library\",\n      \"name\": \"fribidi-shim\",\n      \"version\": \"1.x\",\n      \"description\": \"FriBiDi runtime-loading shim (vendored in src/thirdparty/fribidi-shim/); loads libfribidi dynamically\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"LGPL-2.1-or-later\"\n          }\n        }\n      ],\n      \"hashes\": [\n        {\n          \"alg\": \"SHA-256\",\n          \"content\": \"7e8cfa78dcd21cebeb0ad91c0cd23e0dba6496c0fbd66e1ec3d25c5b1b365d11\"\n        }\n      ],\n      \"pedigree\": {\n        \"notes\": \"Pillow-authored shim; not taken from an upstream project.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://github.com/fribidi/fribidi\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:github/python/pythoncapi-compat\",\n      \"type\": \"library\",\n      \"name\": \"pythoncapi_compat\",\n      \"description\": \"Backport header for new CPython C-API functions (vendored in src/thirdparty/pythoncapi_compat.h)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"0BSD\"\n          }\n        }\n      ],\n      \"hashes\": [\n        {\n          \"alg\": \"SHA-256\",\n          \"content\": \"97b0e62657965bd01a783b93422a6f7138d64c48546657feacc218ec8319ee0b\"\n        }\n      ],\n      \"pedigree\": {\n        \"notes\": \"Vendored unmodified from upstream python/pythoncapi-compat.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"vcs\",\n          \"url\": \"https://github.com/python/pythoncapi-compat\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pillow@12.3.0#thirdparty/raqm\",\n      \"type\": \"library\",\n      \"name\": \"raqm\",\n      \"version\": \"0.10.5\",\n      \"description\": \"Complex text layout library (vendored in src/thirdparty/raqm/)\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT\"\n          }\n        }\n      ],\n      \"hashes\": [\n        {\n          \"alg\": \"SHA-256\",\n          \"content\": \"5549e7458674077ca4794033ade277910ba0ad6989651787eba1a8b5513a9f9d\"\n        }\n      ],\n      \"pedigree\": {\n        \"ancestors\": [\n          {\n            \"bom-ref\": \"pkg:github/HOST-Oman/libraqm@0.10.5#upstream\",\n            \"type\": \"library\",\n            \"name\": \"raqm\",\n            \"version\": \"0.10.5\",\n            \"purl\": \"pkg:github/HOST-Oman/libraqm@0.10.5\",\n            \"externalReferences\": [\n              {\n                \"type\": \"distribution\",\n                \"url\": \"https://github.com/HOST-Oman/libraqm/releases/tag/v0.10.5\"\n              }\n            ]\n          }\n        ],\n        \"patches\": [\n          {\n            \"type\": \"unofficial\",\n            \"diff\": {\n              \"text\": {\n                \"content\": \"LS0tIGEvc3JjL3JhcW0tdmVyc2lvbi5oLmluCisrKyBiL3NyYy9yYXFtLXZlcnNpb24uaApAQCAtMzEsMTQgKzMxLDE0IEBACiAjaWZuZGVmIF9SQVFNX1ZFUlNJT05fSF8KICNkZWZpbmUgX1JBUU1fVkVSU0lPTl9IXwogCi0jZGVmaW5lIFJBUU1fVkVSU0lPTl9NQUpPUiBAUkFRTV9WRVJTSU9OX01BSk9SQAotI2RlZmluZSBSQVFNX1ZFUlNJT05fTUlOT1IgQFJBUU1fVkVSU0lPTl9NSU5PUkAKLSNkZWZpbmUgUkFRTV9WRVJTSU9OX01JQ1JPIEBSQVFNX1ZFUlNJT05fTUlDUk9ACisjZGVmaW5lIFJBUU1fVkVSU0lPTl9NQUpPUiAwCisjZGVmaW5lIFJBUU1fVkVSU0lPTl9NSU5PUiAxMAorI2RlZmluZSBSQVFNX1ZFUlNJT05fTUlDUk8gNQogCi0jZGVmaW5lIFJBUU1fVkVSU0lPTl9TVFJJTkcgIkBSQVFNX1ZFUlNJT05AIgorI2RlZmluZSBSQVFNX1ZFUlNJT05fU1RSSU5HICIwLjEwLjUiCiAKICNkZWZpbmUgUkFRTV9WRVJTSU9OX0FUTEVBU1QobWFqb3IsbWlub3IsbWljcm8pIFwKLQkoKG1ham9yKSoxMDAwMCsobWlub3IpKjEwMCsobWljcm8pIDw9IFwKLQkgUkFRTV9WRVJTSU9OX01BSk9SKjEwMDAwK1JBUU1fVkVSU0lPTl9NSU5PUioxMDArUkFRTV9WRVJTSU9OX01JQ1JPKQorICAgICgobWFqb3IpKjEwMDAwKyhtaW5vcikqMTAwKyhtaWNybykgPD0gXAorICAgICBSQVFNX1ZFUlNJT05fTUFKT1IqMTAwMDArUkFRTV9WRVJTSU9OX01JTk9SKjEwMCtSQVFNX1ZFUlNJT05fTUlDUk8pCiAKICNlbmRpZiAvKiBfUkFRTV9WRVJTSU9OX0hfICovCg==\",\n                \"encoding\": \"base64\"\n              }\n            }\n          },\n          {\n            \"type\": \"unofficial\",\n            \"diff\": {\n              \"text\": {\n                \"content\": \"LS0tIGEvc3JjL3JhcW0uYworKysgYi9zcmMvcmFxbS5jCkBAIC0zNiw3ICszNiwxMSBAQAogI2luY2x1ZGUgPFNoZWVuQmlkaS5oPgogI2VuZGlmCiAjZWxzZQorI2lmZGVmIEhBVkVfRlJJQklESV9TWVNURU0KICNpbmNsdWRlIDxmcmliaWRpLmg+CisjZWxzZQorI2luY2x1ZGUgIi4uL2ZyaWJpZGktc2hpbS9mcmliaWRpLmgiCisjZW5kaWYKICNlbmRpZgogCiAjaW5jbHVkZSA8aGIuaD4K\",\n                \"encoding\": \"base64\"\n              }\n            }\n          }\n        ],\n        \"notes\": \"Vendored from upstream HOST-Oman/libraqm v0.10.5 with two Pillow-specific modifications: (1) raqm-version.h.in was pre-processed into raqm-version.h with version placeholders replaced by literal values; (2) raqm.c wraps the  include in an #ifdef HAVE_FRIBIDI_SYSTEM guard so Pillow's bundled fribidi-shim is used when a system FriBiDi is absent.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"vcs\",\n          \"url\": \"https://github.com/python-pillow/Pillow/tree/main/src/thirdparty/raqm\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/freetype2\",\n      \"type\": \"library\",\n      \"name\": \"FreeType\",\n      \"version\": \"2.14.3\",\n      \"scope\": \"optional\",\n      \"description\": \"Font rendering (optional, used by PIL._imagingft). Required for text/font support.\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"FTL\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://freetype.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://download.savannah.gnu.org/releases/freetype/\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/fribidi\",\n      \"type\": \"library\",\n      \"name\": \"FriBiDi\",\n      \"version\": \"1.0.16\",\n      \"scope\": \"optional\",\n      \"description\": \"Unicode bidi algorithm library (optional, loaded at runtime by fribidi-shim).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"LGPL-2.1-or-later\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://github.com/fribidi/fribidi\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/fribidi/fribidi/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/harfbuzz\",\n      \"type\": \"library\",\n      \"name\": \"HarfBuzz\",\n      \"version\": \"14.2.1\",\n      \"scope\": \"optional\",\n      \"description\": \"Text shaping (optional, required by libraqm for complex text layout).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://harfbuzz.github.io\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/harfbuzz/harfbuzz/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libavif\",\n      \"type\": \"library\",\n      \"name\": \"libavif\",\n      \"version\": \"1.4.2\",\n      \"scope\": \"optional\",\n      \"description\": \"AVIF codec (optional, used by PIL._avif).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-2-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://github.com/AOMediaCodec/libavif\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/AOMediaCodec/libavif/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libimagequant\",\n      \"type\": \"library\",\n      \"name\": \"libimagequant\",\n      \"version\": \"4.4.1\",\n      \"scope\": \"optional\",\n      \"description\": \"Improved colour quantization (optional).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"GPL-3.0-or-later\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://pngquant.org/lib/\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/ImageOptim/libimagequant/tags\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libjpeg\",\n      \"type\": \"library\",\n      \"name\": \"libjpeg / libjpeg-turbo\",\n      \"version\": \"3.1.4.1\",\n      \"description\": \"JPEG codec (required by default; disable with -C jpeg=disable).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"IJG\"\n          }\n        },\n        {\n          \"license\": {\n            \"id\": \"BSD-3-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://ijg.org\"\n        },\n        {\n          \"type\": \"website\",\n          \"url\": \"https://libjpeg-turbo.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/libjpeg-turbo/libjpeg-turbo/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libtiff\",\n      \"type\": \"library\",\n      \"name\": \"libtiff\",\n      \"version\": \"4.7.1\",\n      \"scope\": \"optional\",\n      \"description\": \"TIFF codec (optional).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"libtiff\"\n          }\n        }\n      ],\n      \"pedigree\": {\n        \"ancestors\": [\n          {\n            \"bom-ref\": \"pkg:generic/libtiff@4.7.1#upstream\",\n            \"type\": \"library\",\n            \"name\": \"libtiff\",\n            \"version\": \"4.7.1\",\n            \"purl\": \"pkg:generic/libtiff@4.7.1\",\n            \"externalReferences\": [\n              {\n                \"type\": \"distribution\",\n                \"url\": \"https://gitlab.com/libtiff/libtiff/-/tags/v4.7.1\"\n              }\n            ]\n          }\n        ],\n        \"patches\": [\n          {\n            \"type\": \"cherry-pick\",\n            \"diff\": {\n              \"text\": {\n                \"content\": \"Y29tbWl0IDc4MmExMWQ2YjViNjFjNmRjMjFlNzE0OTUwYTRhZjViZjg5ZjAyM2MKQXV0aG9yOiBFdmVuIFJvdWF1bHQgPGV2ZW4ucm91YXVsdEBzcGF0aWFseXMuY29tPgpEYXRlOiAgIFN1biBGZWIgMjIgMjM6MzI6NDcgMjAyNiArMDEwMAoKICAgIFRJRkZSZWFkUkdCQUltYWdlKCk6IHByZXZlbnQgaW50ZWdlciBvdmVyZmxvdyBhbmQgbGF0ZXIgaGVhcCBvdmVyZmxvdyBvbiBpbWFnZXMgd2l0aCBodWdlIHdpZHRoIGluIFlDYkNyIHRpbGUgZGVjb2RpbmcgZnVuY3Rpb25zCgogICAgRml4ZXMgaHR0cHM6Ly9naXRsYWIuY29tL2xpYnRpZmYvbGlidGlmZi8tL2lzc3Vlcy83ODcKCmRpZmYgLS1naXQgYS9saWJ0aWZmL3RpZl9nZXRpbWFnZS5jIGIvbGlidGlmZi90aWZfZ2V0aW1hZ2UuYwppbmRleCA0NTQzZGRkYS4uZmE4MmQwOTEgMTAwNjQ0Ci0tLSBsaWJ0aWZmL3RpZl9nZXRpbWFnZS5jCisrKyBsaWJ0aWZmL3RpZl9nZXRpbWFnZS5jCkBAIC0yMjI0LDcgKzIyMjQsNyBAQCBERUNMQVJFQ29udGlnUHV0RnVuYyhwdXRjb250aWc4Yml0WUNiQ3I0NHRpbGUpCiAgICAgdWludDMyX3QgKmNwMSA9IGNwICsgdyArIHRvc2tldzsKICAgICB1aW50MzJfdCAqY3AyID0gY3AxICsgdyArIHRvc2tldzsKICAgICB1aW50MzJfdCAqY3AzID0gY3AyICsgdyArIHRvc2tldzsKLSAgICBpbnQzMl90IGluY3IgPSAzICogdyArIDQgKiB0b3NrZXc7CisgICAgY29uc3QgdG1zaXplX3QgaW5jciA9IDMgKiAodG1zaXplX3QpdyArIDQgKiAodG1zaXplX3QpdG9za2V3OwoKICAgICAodm9pZCl5OwogICAgIC8qIGFkanVzdCBmcm9tc2tldyAqLwpAQCAtMjM2NCw3ICsyMzY0LDcgQEAgREVDTEFSRUNvbnRpZ1B1dEZ1bmMocHV0Y29udGlnOGJpdFlDYkNyNDR0aWxlKQogREVDTEFSRUNvbnRpZ1B1dEZ1bmMocHV0Y29udGlnOGJpdFlDYkNyNDJ0aWxlKQogewogICAgIHVpbnQzMl90ICpjcDEgPSBjcCArIHcgKyB0b3NrZXc7Ci0gICAgaW50MzJfdCBpbmNyID0gMiAqIHRvc2tldyArIHc7CisgICAgY29uc3QgdG1zaXplX3QgaW5jciA9IDIgKiAodG1zaXplX3QpdG9za2V3ICsgdzsKCiAgICAgKHZvaWQpeTsKICAgICBmcm9tc2tldyA9IChmcm9tc2tldyAvIDQpICogKDQgKiAyICsgMik7CkBAIC0yNTIyLDcgKzI1MjIsNyBAQCBERUNMQVJFQ29udGlnUHV0RnVuYyhwdXRjb250aWc4Yml0WUNiQ3I0MXRpbGUpCiBERUNMQVJFQ29udGlnUHV0RnVuYyhwdXRjb250aWc4Yml0WUNiQ3IyMnRpbGUpCiB7CiAgICAgdWludDMyX3QgKmNwMjsKLSAgICBpbnQzMl90IGluY3IgPSAyICogdG9za2V3ICsgdzsKKyAgICBjb25zdCB0bXNpemVfdCBpbmNyID0gMiAqICh0bXNpemVfdCl0b3NrZXcgKyB3OwogICAgICh2b2lkKXk7CiAgICAgZnJvbXNrZXcgPSAoZnJvbXNrZXcgLyAyKSAqICgyICogMiArIDIpOwogICAgIGNwMiA9IGNwICsgdyArIHRvc2tldzsKQEAgLTI2MjUsNyArMjYyNSw3IEBAIERFQ0xBUkVDb250aWdQdXRGdW5jKHB1dGNvbnRpZzhiaXRZQ2JDcjIxdGlsZSkKIERFQ0xBUkVDb250aWdQdXRGdW5jKHB1dGNvbnRpZzhiaXRZQ2JDcjEydGlsZSkKIHsKICAgICB1aW50MzJfdCAqY3AyOwotICAgIGludDMyX3QgaW5jciA9IDIgKiB0b3NrZXcgKyB3OworICAgIGNvbnN0IHRtc2l6ZV90IGluY3IgPSAyICogKHRtc2l6ZV90KXRvc2tldyArIHc7CiAgICAgKHZvaWQpeTsKICAgICBmcm9tc2tldyA9IChmcm9tc2tldyAvIDEpICogKDEgKiAyICsgMik7CiAgICAgY3AyID0gY3AgKyB3ICsgdG9za2V3Owo=\",\n                \"encoding\": \"base64\"\n              }\n            }\n          }\n        ],\n        \"notes\": \"Vendored from upstream libtiff v4.7.1 with a commit from master cherry-picked to fix CVE-2026-4775.\"\n      },\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://libtiff.gitlab.io/libtiff/\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://download.osgeo.org/libtiff/\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libwebp\",\n      \"type\": \"library\",\n      \"name\": \"libwebp\",\n      \"version\": \"1.6.0\",\n      \"scope\": \"optional\",\n      \"description\": \"WebP codec (optional, used by PIL._webp).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-3-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://chromium.googlesource.com/webm/libwebp\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://chromium.googlesource.com/webm/libwebp\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/libxcb\",\n      \"type\": \"library\",\n      \"name\": \"libxcb\",\n      \"version\": \"1.17.0\",\n      \"scope\": \"optional\",\n      \"description\": \"X11 screen-grab support (optional, used by PIL._imaging on macOS and Linux).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"X11\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://xcb.freedesktop.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://xcb.freedesktop.org/dist/\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/littlecms2\",\n      \"type\": \"library\",\n      \"name\": \"Little CMS 2\",\n      \"version\": \"2.19.1\",\n      \"scope\": \"optional\",\n      \"description\": \"Colour management (optional, used by PIL._imagingcms).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"MIT\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://www.littlecms.com\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/mm2/Little-CMS/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/openjpeg\",\n      \"type\": \"library\",\n      \"name\": \"OpenJPEG\",\n      \"version\": \"2.5.4\",\n      \"scope\": \"optional\",\n      \"description\": \"JPEG 2000 codec (optional).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-2-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://www.openjpeg.org\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/uclouvain/openjpeg/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:pypi/pybind11\",\n      \"type\": \"library\",\n      \"name\": \"pybind11\",\n      \"scope\": \"excluded\",\n      \"description\": \"Parallel C compilation library (build-time dependency).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"BSD-3-Clause\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://pybind11.readthedocs.io\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://github.com/pybind/pybind11/releases\"\n        }\n      ]\n    },\n    {\n      \"bom-ref\": \"pkg:generic/zlib\",\n      \"type\": \"library\",\n      \"name\": \"zlib\",\n      \"version\": \"2.3.3\",\n      \"description\": \"Deflate/PNG compression (required by default; disable with -C zlib=disable).\",\n      \"licenses\": [\n        {\n          \"license\": {\n            \"id\": \"Zlib\"\n          }\n        }\n      ],\n      \"externalReferences\": [\n        {\n          \"type\": \"website\",\n          \"url\": \"https://zlib.net\"\n        },\n        {\n          \"type\": \"distribution\",\n          \"url\": \"https://zlib.net\"\n        }\n      ]\n    }\n  ],\n  \"dependencies\": [\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0\",\n      \"dependsOn\": [\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmath\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingmorph\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingtk\",\n        \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._avif\",\n      \"dependsOn\": [\n        \"pkg:generic/libavif\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imaging\",\n      \"dependsOn\": [\n        \"pkg:generic/libimagequant\",\n        \"pkg:generic/libjpeg\",\n        \"pkg:generic/libtiff\",\n        \"pkg:generic/libxcb\",\n        \"pkg:generic/openjpeg\",\n        \"pkg:generic/zlib\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingcms\",\n      \"dependsOn\": [\n        \"pkg:generic/littlecms2\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._imagingft\",\n      \"dependsOn\": [\n        \"pkg:generic/freetype2\",\n        \"pkg:generic/fribidi\",\n        \"pkg:generic/harfbuzz\",\n        \"pkg:pypi/pillow@12.3.0#thirdparty/fribidi-shim\",\n        \"pkg:pypi/pillow@12.3.0#thirdparty/raqm\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#c-ext/PIL._webp\",\n      \"dependsOn\": [\n        \"pkg:generic/libwebp\"\n      ]\n    },\n    {\n      \"ref\": \"pkg:pypi/pillow@12.3.0#thirdparty/raqm\",\n      \"dependsOn\": [\n        \"pkg:generic/harfbuzz\",\n        \"pkg:pypi/pillow@12.3.0#thirdparty/fribidi-shim\"\n      ]\n    }\n  ]\n}\n", "creation_timestamp": "2026-10-02T12:26:42.000000Z"}]}