Debian sticks with ESR releases (Wheezy will have Iceweasel 10) but I'd
assume Ubuntu doesn't because they like having bleeding-edge software.
As for Abrowser/IceCat versions, I don't really worry too much because I run
with JavaScript disabled. Looking at Mozilla's Security Advisories, it seems
that *most* Mozilla security bugs are related to JavaScript.
In fact, Mozilla even notes this:
"Note: In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products."
https://www.mozilla.org/security/announce/
For users that do have JavaScript enabled, compiling IceCat or similar
shouldn't be too difficult.
