Security issues were identified and fixed in mozilla firefox and
thunderbird:

Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and
4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0,
and SeaMonkey before 2.7 might allow remote attackers to execute
arbitrary code via vectors related to incorrect AttributeChildRemoved
notifications that affect access to removed nsDOMAttribute child nodes
(CVE-2011-3659).

Mozilla Firefox before 3.6.26 and 4.x through 6.0, Thunderbird before
3.1.18 and 5.0 through 6.0, and SeaMonkey before 2.4 do not properly
enforce the IPv6 literal address syntax, which allows remote attackers
to obtain sensitive information by making XMLHttpRequest calls through
a proxy and reading the error messages (CVE-2011-3670).

Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18
and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers
to cause a denial of service (memory corruption and application crash)
or possibly execute arbitrary code via unknown vectors (CVE-2012-0442).

Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey
before 2.7 allow remote attackers to cause a denial of service (memory
corruption and application crash) or possibly execute arbitrary code
via unknown vectors (CVE-2012-0443).

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before
3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly
initialize nsChildView data structures, which allows remote attackers
to cause a denial of service (memory corruption and application crash)
or possibly execute arbitrary code via a crafted Ogg Vorbis file
(CVE-2012-0444).

Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0,
and SeaMonkey before 2.7 allow remote attackers to bypass the
HTML5 frame-navigation policy and replace arbitrary sub-frames by
creating a form submission target with a sub-frame's name attribute
(CVE-2012-0445).

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox
4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7
allow remote attackers to inject arbitrary web script or HTML via a (1)
web page or (2) Firefox extension, related to improper enforcement of
XPConnect security restrictions for frame scripts that call untrusted
objects (CVE-2012-0446).

Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0,
and SeaMonkey before 2.7 do not properly initialize data for
image/vnd.microsoft.icon images, which allows remote attackers to
obtain potentially sensitive information by reading a PNG image that
was created through conversion from an ICO image (CVE-2012-0447).

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird
before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow
remote attackers to cause a denial of service (memory corruption and
application crash) or possibly execute arbitrary code via a malformed
XSLT stylesheet that is embedded in a document (CVE-2012-0449).

Mozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux
and Mac OS X set weak permissions for Firefox Recovery Key.html,
which might allow local users to read a Firefox Sync key via standard
filesystem operations (CVE-2012-0450).

Additionally the libvpx packages has been upgraded to the 0.9.7
version for Mandriva Linux 2011 which is required by firefox 10.0.