1) Common Vulnerabilities and Exposures assigned an identifier CVE-2012-3981 to the following vulnerability:

Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt.

  Upstream advisory:
  [1] http://www.bugzilla.org/security/3.6.10/

  Upstream bug report:
  [2] https://bugzilla.mozilla.org/show_bug.cgi?id=785470

  Upstream patches:
  [3] http://bzr.mozilla.org/bugzilla/trunk/revision/8370
      (against trunk)
  [4] http://bzr.mozilla.org/bugzilla/4.2/revision/8132
      (against 4.2 branch)
  [5] http://bzr.mozilla.org/bugzilla/4.0/revision/7721
      (against 4.0 branch)
  [6] http://bzr.mozilla.org/bugzilla/3.6/revision/7297
      (against 3.6 branch)

  References:
  [7] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3981
  [8] https://bugzilla.mozilla.org/show_bug.cgi?id=785112

2) Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4747 to the following vulnerability:

Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to read (1) template (aka .tmpl) files, (2) other custom extension files under extensions/, or (3) custom documentation files under docs/ via a direct request.

References:
[9]  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4747
[10] http://www.bugzilla.org/security/3.6.10/
[11] https://bugzilla.mozilla.org/show_bug.cgi?id=785511
[12] https://bugzilla.mozilla.org/show_bug.cgi?id=785522