Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18.0 Thunderbird before 17.0.2 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.