Thanks for Iceweasel and XULRunner updates fixing security bugs. Looking at http://security-tracker.debian.org/tracker/status/release/stable-backports I notice that nspr library looks vulnerable in backports. But I have installed (because Iceweasel doesn't pull backported version) older Lenny version of libnspr4-0d that is not vulnerable. At least nspr should be updated in backports and maybe Iceweasel depends made more strict?