CVE-2012-0465: Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when...

Security readout for executives and security teams

This Bugzilla flaw can weaken account lockout protections on affected installations using inbound proxy support. An attacker may avoid IP-based lockout tracking during repeated login attempts. It does not prove account compromise by itself, but it increases password-guessing risk for exposed Bugzilla sites. Exposure is likely limited to Bugzilla deployments in the listed vulnerable version ranges with inbound_proxies enabled, commonly behind reverse proxies. Systems not using that option are not described as affected in the provided sources. Treat this as a moderate priority if Bugzilla is internet-facing or contains sensitive engineering data. The main business risk is increased credential-guessing exposure, not direct system takeover based on the supplied evidence. Mitigation focus: Upgrade Bugzilla to 3.6.9, 4.0.6, 4.2.1, or a later maintained release.; Check vendor advisories for branch-specific upgrade guidance.; Disable inbound_proxies if it is not operationally required..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.