Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not
properly sanitize the content of the "buildid" parameter when filing
bugs (CVE-2007-4543). The next two vulnerabilities only affect Bugzilla
2.23.3 or later, hence the stable Gentoo Portage tree does not contain
these two vulnerabilities: Loic Minier reported that the
"Email::Send::Sendmail()" function does not properly sanitise "from"
email information before sending it to the "-f" parameter of
/usr/sbin/sendmail (CVE-2007-4538), and Frédéric Buclin discovered
that the XML-RPC interface does not correctly check permissions in the
time-tracking fields (CVE-2007-4539).
