Mozilla Firefox before 15.0 Firefox ESR 10.x before 10.0.7 Thunderbird before 15.0 Thunderbird ESR 10.x before 10.0.7 and SeaMonkey before 2.12 do not properly iterate through the characters in a text run which allows remote attackers to execute arbitrary code via a crafted document.