Update to bugzilla 4 (or at least 3.6.4).
It is reported that the preliminary patch for https://bugzilla.mozilla.org/show_bug.cgi?id=621591 was applied here (not sure about the final one) but there are other security issues fixed in newer versions.
Version: unspecified
Severity: enhancement