Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3 does not properly manage pointers for the columns (aka TreeColumns) of a XUL tree element which allows remote attackers to execute arbitrary code via a crafted HTML document related to a \dangling pointer vulnerability.\