Takeaway:<p>&gt; We believe that the attacker used information from Bugzilla to exploit the vulnerability we patched on August 6...The version of Firefox released on August 27 fixed all of the vulnerabilities that the attacker learned about and could have used to harm Firefox users.<p>I find this an interesting attack vector for a capital-O Open Source project. In the spirit of openness, how does a community correctly label bugs versus vulnerabilities?