These two fields allow to specify a different default assignee for ticket opened against this package in bugzilla. Note: The EPEL field is always displayed for packages in the 'rpms' namespace regardless of whether it is used in bugzilla or not.
2932701
CVE-2016-7966, KMail: HTML injection in plain text viewer