Re: [SECURITY] [DSA 1751-1] New xulrunner packages fix several vulnerabilities
The closest I could come in a few minutes of Googling was this announcement from Mozilla:
This terminated support for Firefox 2 in mid-December 2008. This is not to say that Debian terminated support on the same date, however. I can't find any official announcement from the project stating that Firefox 2 support has ended.