Rolf Leggewie discovered two information disclosure bugs in reportbug.
The per-user configuration file ~/.reportbugrc was created world-readable. If it contained email smarthost passwords, these were readable by any other user on the computer storing the home directory.
reportbug usually includes the settings from ~/.reportbugrc in generated bug reports. This included the “smtppasswd” setting (the password for an SMTP email smarthost) as well. The password is now hidden from reports.