From the Ubuntu advisory:
Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary, Kyle Huey, Ed
Morley, Chris Lord, Boris Zbarsky, Julian Seward, Bill McCloskey, and
Andrew McCreight discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2012-5842, CVE-2012-5843)
Jonathan Stephens discovered that combining vectors involving the setting
of Cascading Style Sheets (CSS) properties in conjunction with SVG text
could cause Firefox to crash. If a user were tricked into opening a
malicious web page, an attacker could cause a denial of service via
application crash or execute arbitrary code with the privliges of the user
invoking the program. (CVE-2012-5836)
It was discovered that if a javascript: URL is selected from the list of
Firefox "new tab" page, the script will inherit the privileges of the
privileged "new tab" page. This allows for the execution of locally
installed programs if a user can be convinced to save a bookmark of a
malicious javascript: URL. (CVE-2012-4203)
Scott Bell discovered a memory corruption issue in the JavaScript engine.
If a user were tricked into opening a malicious website, an attacker could
exploit this to execute arbitrary JavaScript code within the context of
another website or arbitrary code as the user invoking the program.
(CVE-2012-4204)
Gabor Krizsanits discovered that XMLHttpRequest objects created within
sandboxes have the system principal instead of the sandbox principal. This
can lead to cross-site request forgery (CSRF) or information theft via an
add-on running untrusted code in a sandbox. (CVE-2012-4205)
Peter Van der Beken discovered XrayWrapper implementation in Firefox does
not consider the compartment during property filtering. An attacker could
use this to bypass intended chrome-only restrictions on reading DOM object
properties via a crafted web site. (CVE-2012-4208)
Abhishek Arya discovered multiple use-after-free and buffer overflow issues
in Firefox. If a user were tricked into opening a malicious page, an
attacker could exploit these to execute arbitrary code as the user invoking
the program. (CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829,
CVE-2012-5839, CVE-2012-5840, CVE-2012-4212, CVE-2012-4213, CVE-2012-4217,
CVE-2012-4218)
Several memory corruption flaws were discovered in Firefox. If a user were
tricked into opening a malicious page, an attacker could exploit these to
execute arbitrary code as the user invoking the program. (CVE-2012-5830,
CVE-2012-5833, CVE-2012-5835, CVE-2012-5838) | 