Both of these are critical - damn.

According to Secunia this code is publicly available - meaning that every script kiddie has access - not good.

If you have any sites other than update.mozilla.org or addons.mozilla.org added to your trusted sites they must be removed.

1) Tools - Options- Web Features.
2) Click the "Allow web sites to install software" checkbox (if already checked proceed to next step) then click the "Allowed Sites" button.
3) Highlight each site in turn that is not update.mozilla.org or addons.mozilla.org and click "Remove Site" button.
4) Click OK.
5) Click OK.