CVE-2009-0486: Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, wh...

Security readout for executives and security teams

This flaw affects certain older Bugzilla releases when deployed under Apache mod_perl. Poor token randomness can weaken CSRF protection, letting a remote attacker cause unauthorized actions as another user. The issue is deployment-specific and old, but exposed legacy Bugzilla systems could still present business risk. Likely exposure is limited to self-hosted Bugzilla instances on versions 3.2.1, 3.0.7, or 3.3.2 running under Apache mod_perl. Organizations using packaged Fedora Bugzilla builds from 2009 should verify whether the referenced updates were applied. Treat this as a legacy exposure cleanup item unless an affected Bugzilla instance is still internet-facing or business-critical. For exposed systems, prioritize verification and patching because compromise could affect issue-tracking integrity and user-account actions. Mitigation focus: Identify any Bugzilla 3.2.1, 3.0.7, or 3.3.2 deployments.; Confirm whether affected deployments run under Apache mod_perl.; Apply applicable Bugzilla or Fedora security updates from the referenced advisories..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.