CVE-2010-4572: CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6....

Security readout for executives and security teams

This is an old Bugzilla web issue where specially crafted input to chart.cgi could make the server add unintended HTTP headers. In business terms, exposed legacy Bugzilla systems could be used to manipulate browser or proxy responses. The source bundle does not show active exploitation or a CVSS score. Exposure is most likely where legacy Bugzilla installations remain deployed, especially if chart.cgi is reachable by users or the internet. Modern Bugzilla versions should not be assumed affected from this bundle alone. Treat this as a legacy application hygiene issue with moderate urgency. Prioritize internet-facing or business-critical Bugzilla systems first, then retire or upgrade unsupported versions. Mitigation focus: Upgrade Bugzilla beyond the affected version ranges named in the advisory.; Apply distribution vendor updates where Bugzilla came from Fedora or Debian packages.; Restrict external access to legacy Bugzilla until version status is confirmed..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.