A new version of Firefox, 2.0.0.13, has been released today. It is available for manual download directly from www.mozilla.com. It is also already available for automatic download, but remember (if you are running Windows) that the "Help --> Check for Updates..." menu option is greyed out if you don't have Administrator privileges.

UPDATE: The "Known Vulnerabilities in Mozilla Products" Web page now shows the details. Six vulnerabilities are fixed: two critical, two high, one moderate and one low, some of them referencing multiple CVE's (please, check the Mozilla web page for details).

The most relevant one seems to be MFSA 2008-14: "JavaScript privilege escalation and arbitrary code execution". Another good reason to run the NoScript add-on. It is associated to three CVE identifiers. Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail (not the default setting and not recommended).

Thanks roseman and other anonymous readers for the heads up, and those that alerted us to the availability of the updated Known Vulnerabilities page.
--
Raul Siles
www.raulsiles.com