Sql injection

Bugzilla 2.16.10 does not properly handle certain characters in the 1 maxpatchsize and 2 maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error...