thunderbird is vulnerable to cross-site scripting (XSS). A cross-site scripting (XSS) flaw was found in the way Thunderbird handled certain multibyte character sets. Malicious, remote content could cause Thunderbird to run JavaScript code with the permissions of different remote content.
lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
www.mozilla.org/security/announce/2011/mfsa2011-47.html
www.redhat.com/support/errata/RHSA-2011-1439.html
access.redhat.com/errata/RHSA-2011:1438
access.redhat.com/security/updates/classification/#moderate
bugzilla.mozilla.org/show_bug.cgi?id=690225
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14212