The browser engine in Mozilla Firefox before 2.0.0.12 Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to the (1) nsTableFrame::GetFrameAtOrBefore (2) nsAccessibilityService::GetAccessible (3) nsBindingManager::GetNestedInsertionPoint (4) nsXBLPrototypeBinding::AttributeChanged (5) nsColumnSetFrame::GetContentInsertionFrame and (6) nsLineLayout::TrimTrailingWhiteSpaceIn methods and other vectors.