CVE-2009-3386: Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 allows remote attackers to discover the a...

Security readout for executives and security teams

This is an information disclosure issue in older Bugzilla versions. A remote user could learn the alias of a private bug by viewing Depends On or Blocks fields on a related bug. This may expose sensitive project, vulnerability, customer, or incident identifiers, but the source bundle does not show code execution or system compromise. Exposure is limited to organizations running the listed Bugzilla versions with private bugs and related public or accessible bugs. Internet-facing Bugzilla instances increase likelihood of untrusted access. Systems not using affected versions are not indicated as exposed by the provided sources. Treat as a privacy and confidentiality issue, not a takeover vulnerability. Prioritize remediation if Bugzilla contains security defects, customer data, unreleased product plans, or incident work. Urgency is lower if no affected Bugzilla versions are present or private bugs are not used. Mitigation focus: Identify any Bugzilla instances and their exact versions.; Prioritize instances running Bugzilla 3.3.2-3.4.3 or 3.5-3.5.1.; Review the Bugzilla security advisory for vendor-approved fixed versions or patches..

Prepared

Jun 28, 2026, 16:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.