Critical vulnerabilities are those that can allow attackers to install code without user interaction. One could lead to privilege escalation and the execution of arbitrary code after bypassing System Only Wrappers and cloning a protected node. A second critical vulnerability comprises several memory safety bugs – Mozilla presumes “that with enough effort at least some of these could be exploited to run arbitrary code.” The third critical vulnerability only affects Linux users with a Mesa graphics driver installed, causing a crash when unallocated memory is freed. The result is ‘potentially exploitable.’
High vulnerabilities can be used to gather data or inject data without user interaction beyond standard browsing. Those fixed in Firefox 20 could lead to privilege escalation, involve an out-of-bounds write in the Cairo library leading to a potentially exploitable crash, and include cross-site scripting using timed history navigations.
Moderate vulnerabilities would be classified critical or high except that they only work in uncommon non-default configurations that would require user interaction. Four such fixes are included in Firefox 20.
There are no ‘low’ vulnerabilities fixed in this release. The ‘low’ classification would include minor data leaks or spoofs.
Apart from the fixes, the new version also includes a range of product enhancements. In particular, private browsing can now be per-window, without requiring that the browser be shut down and restarted first. Private browsing is not ‘anonymous browsing’. “Private Browsing allows you to browse the Internet without saving any information about which sites and pages you’ve visited,” explains Mozilla. But it “doesn't make you anonymous on the Internet. Your Internet service provider, employer, or the sites themselves can still track what pages you visit. Private Browsing also doesn't protect you from keyloggers or spyware that may be installed on your computer.”
Paul Ducklin of Sophos explains, “I recommend setting Firefox to delete as much of your history as you can bear to lose (notably including cookies) whenever you exit, as it gives you that bit less to worry about next time you start up the browser. If you use Private Browsing all the time, your ‘delete history on exit’ settings are effectively maximised, because Firefox doesn't keep any history as you browse.”