Ubuntu Security Notice USN-186-1 – Peter Zelezny discovered that URLs which are passed to Firefox or Mozilla on the command line are not correctly protected against interpretation by the shell. If Firefox or Mozilla is configured as the default handler for URLs (which is the default in Ubuntu), this could be exploited to execute arbitrary code with user privileges by tricking the user into clicking on a specially crafted URL (for example, in an email or chat client).
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/40238/USN-186-1.txt
Source: https://packetstormsecurity.com/files/40238/Ubuntu-Security-Notice-186-1.html