Some vulnerabilities have been reported in Thunderbird, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, potentially disclose sensitive information, and potentially compromise a user's system.

For more information:
SA18700

Also, see #1, #15, #16, #18, #19, #20, and #22 in:
SA19631

Success exploitation of some of the vulnerabilities requires that JavaScript is enabled (not enabled by default).

The following weakness and vulnerability have also been reported:

1) An error caused due to certain references to external resources being followed can be exploited to validate the existence of an mail address when a malicious mail is opened using e.g. CSS or an iframe included in-line.

This is related to:
SA13086

2) The problem is that JavaScript code embedded in mails are executed when forwarding a mail in-line. This can be exploited to execute arbitrary JavaScript code with full privileges when a user forwards a malicious mail via the "Forward As" functionality.

This is related to vulnerability #2 in:
SA15907

Solution
Update to version 1.0.8 or 1.5.0.2.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) CrashFr.
2) Georgi Guninski

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) http://www.mozilla.org/security/announce/2006/mfsa2006-26.html
2) http://www.mozilla.org/security/announce/2006/mfsa2006-21.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers