Mozilla on Wednesday patched 11 vulnerabilities in Firefox 3.0 -- and 12 bugs in the older Firefox 2.0 -- that could be used to compromise computers and steal information.
Wednesday's update patched virtually the same number of vulnerabilities as the last security upgrade seven weeks ago.
Firefox 3.0.4, the fourth update since Mozilla launched the browser in June, fixes six flaws marked "critical," two "high," two "moderate," and one "low" in Mozilla's four-step scoring system. Most of the critical bugs could be used by hackers to introduce their own malicious code into a vulnerable system.
That vulnerability was judged moderate by Mozilla because of extenuating circumstances. "It requires an attacker to have malicious code saved locally, then have a user open a chrome: document or privileged about: URI, and then open the malicious file in the same privileged tab," Mozilla said in its advisory .
Mozilla also updated the nearly-retired Firefox to 220.127.116.11, patching all but two of the same vulnerabilities fixed in 3.0.4, and several others for good measure. Of the dozen bugs, six were rated critical. The 18.104.22.168 update will be the next-to-last for the older Firefox 2.0, which will be dropped from support next month.
Before that happens, Mozilla will make one last effort to convince Firefox 2.0 users to upgrade. In two to three weeks users will again be prompted to upgrade in a repeat of an offer first extended in August. Mozilla has been very successful in convincing users to upgrade; as of the end of October, 73 percent of users were running the newer Firefox 3.0, reported Web metrics firm Net Applications.