Mozilla published a new version of its Firefox web browser on Tuesday that fixes five security vulnerabilities, two of which it rates as critical.

Firefox version 3.0.2 fixes a memory corruption bug and a separate critical bug involving privilege escalation and the XPCnativeWrapper component of the browser. Both create possible mechanisms for hackers to inject hostile code into vulnerable systems using rigged websites, or perform similar tricks.

The same two critical bugs are fixed in Firefox 2.0.0.17, for those still using the earlier version of the browser. There's no evidence that either critical flaw has been exploited by hackers but prudence would steer towards early patching. Judging from past experience automatic updates from Mozilla will appear in about a day or so.

The updates also fix three lesser flaws - two of which are rated as moderate and one of which earns a low risk rating.

All five flaws are explained in Mozilla's release notes here and there's additional commentary from the good folk of the Internet Storm Centre here. ®

Related stories

• Firefox update fixes four critical flaws (13 November 2008)

  https://www.theregister.com/2008/11/13/firefox_update/

• Firefox hits 20% share as testers tickle 'pr0n mode' (5 November 2008)

  https://www.theregister.com/2008/11/05/firefox_market_share_private_browsing/

• Mozilla bets big with new R&D group (14 October 2008)

  https://www.theregister.com/2008/10/14/mozilla_developer_tools_lab/

• Firefox update fixes international character password glitch (29 September 2008)

  https://www.theregister.com/2008/09/29/firefox_update_fixes_password_saving_bug/

• Mozilla security chief: Apple should open up (15 September 2008)

  https://www.theregister.com/2008/09/15/snyder_calls_on_apple/

• Internet Explorer - now with 35% less FAIL (29 August 2008)

  https://www.theregister.com/2008/08/29/ie8_beta2_features/

• That password-protected site of yours - it ain't (22 August 2008)

  https://www.theregister.com/2008/08/22/accessing_restricted_sites/

• Mac users urged to ditch Safari (5 August 2008)

  https://www.theregister.com/2008/08/05/ditch_safari_phishing_criticism/

• Firefox sweeps away carpet bombing bug (17 July 2008)

  https://www.theregister.com/2008/07/17/firefox_updates/

• Mozilla insists Firefox 3.1 won't hit bum note for developers (14 July 2008)

  https://www.theregister.com/2008/07/14/firefox_3_1_ass/

• Mozilla develops browser security metrics (8 July 2008)

  https://www.theregister.com/2008/07/08/mozilla_security_metrics/

• Opera update fixes stability bugs (4 July 2008)

  https://www.theregister.com/2008/07/04/opera_update/

• Firefox 3 makes up world record to set world record (3 July 2008)

  https://www.theregister.com/2008/07/03/firefox_3_official_world_record/

• Bugs casts shadow over Firefox 3 (19 June 2008)

  https://www.theregister.com/2008/06/19/firefox3_bugs/