Download or update from within the program (Help / Check for Updates).
What’s New in Firefox 3.6.12
Firefox 3.6.12 fixes a critical security issue that could potentially allow remote code execution.
*note – As of this writing Thunderbird 3.1.6 is currently being pushed to mirrors but is not out yet.