At https://www.debian.org/Bugs/server-control.en.html (coming from
html/server-control.html.in in debbugs):

  The bug tracking system uses this information, in conjunction with
  fixed versions recorded when closing bugs, to display lists of bugs
  open in various versions of each package. It considers a bug to be
  open when it has no fixed version, or when it has been found more
  recently than it has been fixed.

But this text is ambiguous when a bug is assigned to 2 different
packages and is marked as fixed in only one of these packages.

The reality is even more complex than this paragraph, because
found/fixed/absent is dependent on the DAG of package versions, not the
time of upload.

I should crib some text from one of my blog posts a few years ago about
this and add it to the documentation.