Firefox is listening for incoming connections on two ports. Why?
These are local loopback ports. Firefox uses them for local communication.
A loopback connection (to IP address 127.0.0.1) can be made by Firefox on non-Unix machines. In this case the browser is communicating with itself as expected, and it is not recommended that this communication be blocked.
Take a look at this: Connections established on startup - Firefox
And the bug report "Connections opened on loopback (127.0.0.1) show in NETSTAT and ZoneAlarm has "server rights" alerts" explains:
Whenever Mozilla is running there are two connections to the loopback address that are connected to each other. The ports change but they are usually lower-numbered unregistered ports.