Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5 Thunderbird before 6 SeaMonkey 2.x before 2.3 and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long source-code block for a shader.