Interesting that the 2.0.x patch came out yesterday while the 3.0.x patch will hit today. Either way, the vulnerabilities are listed as "critical," so it's good that Mozilla's catching up on these month-old exploits.

"Firefox 3.0.1, the first update since the open-source browser was upgraded almost a month ago, won't reach users until Wednesday at the earliest, according to notes from a Mozilla status meeting published online."

Talk about a major security flaw. This one was so bad that they kept it secret so that companies could get their patches together; in hopes of avoiding any exploits. Yikes.

"Although he informed the US government, the matter was kept under wraps to provide time for the vendors to come up with viable options, a division of the department of homeland security said."

You can find the full details of both over at ITExaminer, which is a summary of the findings from Intego. The ARDAgent one sounds particularly nasty.

"The first is installed a the heart of a poker application and the second, takes advantage of a hole in the ARDAgent."