CVE-2012-0448: Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x a...

Security readout for executives and security teams

Older Bugzilla versions allowed new accounts to use non-ASCII characters in email addresses. That could let an authenticated user create an address that visually resembles another user’s address, increasing the chance of account spoofing and workflow deception. Exposure is most likely where an organization still runs an affected Bugzilla release and permits account creation or user provisioning with email addresses containing non-ASCII characters. Treat this as a cleanup and trust-risk issue, not an emergency based on available evidence. Prioritize if Bugzilla is internet-facing, supports external users, or is used for sensitive engineering or customer workflows. Mitigation focus: Upgrade Bugzilla to a fixed version named in the advisory range.; Prioritize externally reachable or self-registration-enabled Bugzilla instances.; Check Bugzilla vendor guidance before applying compensating controls..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.