the following changes have been pushed to bugzilla.mozilla.org:

• [1229894] Backport bug upstream 1221518 to bmo/4.2 [SECURITY] XSS in dependency graphs when displaying the bug summary
• [1234237] Backport upstream bug 1232785 to bmo/4.2 [SECURITY] Buglists in CSV format can be parsed as valid javascript in some browsers

discuss these changes on mozilla.tools.bmo.

https://dlawrence.wordpress.com/2015/12/23/happy-bmo-push-day-part-2/