Some vulnerabilities have been reported in Mozilla Thunderbird, which can be exploited by malicious people to conduct man-in-the-middle attacks, bypass certain security restrictions, and potentially compromise a user's system.

The problem is that scripts in remote XBL files in e-mails can be executed even when JavaScript has been disabled (JavaScript is disabled by default). This can be exploited to cause JavaScript code to be executed whenever the HTML content of an e-mail is being viewed, forwarded, or replied to. This may also enable exploitation of vulnerabilities requiring JavaScript.

Successful exploitation requires that the "Load Images" setting is enabled.

Some other vulnerabilities have also been reported. For more information:
SA21903

And vulnerabilities #1, #2, #3, and #7 in:
SA21906

NOTE: Exploitation of some of the vulnerabilities requires that JavaScript is enabled.

Solution
Update to version 1.5.0.7.
Further details available to Secunia VIM customers

Provided and/or discovered by
Georgi Guninski

Original Advisory
http://www.mozilla.org/security/announce/2006/mfsa2006-63.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers