CVE-2009-3386

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 allows remote attackers to discover the alias of a private bug by reading the (1) Depends On or (2) Blocks field of a related bug.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/60271
http://secunia.com/advisories/37423Vendor Advisory
http://www.bugzilla.org/security/3.4.3/Patch, Vendor Advisory
http://www.securityfocus.com/bid/37062Patch
http://www.vupen.com/english/advisories/2009/3288Patch, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=529416Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/54332
http://osvdb.org/60271
http://secunia.com/advisories/37423Vendor Advisory
http://www.bugzilla.org/security/3.4.3/Patch, Vendor Advisory
http://www.securityfocus.com/bid/37062Patch
http://www.vupen.com/english/advisories/2009/3288Patch, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=529416Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/54332

Timeline

Published: Nov 20, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-33875.0Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a CVE-2009-33889.3liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of ser CVE-2009-33899.3Integer overflow in libtheora in Xiph.Org Theora before 1.1, as used in Mozilla Firefox 3.5 before 3.5.6 and SeaMonkey before 2.0.1, allows CVE-2009-33907.2Multiple unspecified vulnerabilities in the (1) iscsiadm and (2) iscsitadm programs in Sun Solaris 10, and OpenSolaris snv_28 through snv_10 CVE-2009-33925.4Unspecified vulnerability in the Agile Engineering Data Management (EDM) component in Oracle E-Business Suite 6.1.0.0 allows remote attacker CVE-2009-33934.3Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to CVE-2009-33955.0Unspecified vulnerability in the AutoVue component in Oracle E-Business Suite 19.3.2 allows remote attackers to affect availability via unkn CVE-2009-33964.3Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2.3, 10.0.1, and 10.3 allows remote attackers to CVE-2009-33974.3Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.1 allows remote atta CVE-2009-33994.3Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0.6 and 8.1.5 allows remote attackers to affect integrity,CVE-2009-34005.5Unspecified vulnerability in the Oracle Advanced Benefits component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote a CVE-2009-34011.7Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 all