From MFSA 2008-38: Mozilla security researcher moz_bug_r_a4 reported that the same-origin check in nsXMLDocument::OnChannelRedirect() could be bypassed. This vulnerability could be used to execute JavaScript in the context of a different website.
This is now public
thunderbird-2.0.0.18-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
thunderbird-2.0.0.18-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
This was addressed via: Red Hat Enterprise Linux version 2.1 (seamonkey) RHSA-2008:0882 Red Hat Enterprise Linux version 3 (seamonkey) RHSA-2008:0882 Red Hat Enterprise Linux version 4 (RHSA-2008:0882) Red Hat Enterprise Linux version 4 (thunderbird) RHSA-2008:0908 Red Hat Enterprise Linux Desktop version 5 (thunderbird) RHSA-2008:0908 RHEL Optional Productivity Applications version 5 (thunderbird) RHSA-2008:0908