Multiple vulnerabilities in Mozilla Firefox before 1.5.0.5 Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Javascript that leads to memory corruption including (1) nsListControlFrame::FireMenuItemActiveEvent (2) buffer overflows in the string class in out-of-memory conditions (3) table row and column groups (4) \anonymous box selectors outside of UA stylesheets \ (5) stale references to \removed nodes \ and (6) running the crypto.generateCRMFRequest callback on deleted context.