Use-after-free vulnerability in Mozilla Firefox before 17.0 Firefox ESR 10.x before 10.0.11 Thunderbird before 17.0 Thunderbird ESR 10.x before 10.0.11 and SeaMonkey before 2.14 on Mac OS X allows remote attackers to execute arbitrary code via an HTML document.