CVE-2013-0786: The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x be...

Security readout for executives and security teams

This is an information-disclosure issue in older Bugzilla releases. A remote user could learn whether private product names exist because invalid product queries returned different errors. It does not indicate code execution or data theft, but exposed product names can reveal sensitive projects, customers, or security work. Exposure is limited to organizations running affected Bugzilla versions with private products and reachable query functionality. Publicly exposed Bugzilla instances carry higher business risk than internal-only deployments. Treat as a targeted confidentiality risk. Prioritize internet-facing Bugzilla systems or instances tracking sensitive products, customers, vulnerabilities, or unreleased initiatives. Mitigation focus: Upgrade affected Bugzilla deployments to fixed vendor-supported versions.; Review Bugzilla and distribution vendor advisories for exact package guidance.; Disable unnecessary debug behavior on production Bugzilla instances..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.