In run-icecat.sh in the latest icecat svn are lines such as : LD_LIBRARY_PATH=${MOZ_DIST_BIN}:${MOZ_DIST_BIN}/plugins:${MRE_HOME}${LD_LIBRARY_PATH+":$LD_LIBRARY_PATH"}
Note that this insecure LD_LIBRARY_PATH would lead icecat to search in the current working directory for libraries. If malicious libraries are, for example, downloaded off the Internet, then those would be loaded instead.
This can be simply fixed as follows (note the : following LD_LIBRARY_PATH):