thunderbird: multiple issues

• CVE-2015-7201 (cross-origin restriction bypass using data: and
  view-source: uri scheme):

Security researcher Tsubasa Iinuma reported a mechanism to violate
same-origin policy to content using data: and view-source: URIs to
confuse protections and bypass restrictions. This resulted in the
ability to read data from cross-site URLs and local files.

• CVE-2015-7205 (overflow in MPEG4Extractor::readMetaData causes
  memory-safety bug):

Security researcher Ronald Crane reported a vulnerability found through
code inspection. This issue is an integer overflow while processing an
MP4 format video file when an a erroneously-small buffer is allocated
and then overrun, resulting in a potentially exploitable crash.

• CVE-2015-7212 (underflow in RTPReceiverVideo::ParseRtpPacket causes
  memory-safety bug and information leak):

Security researcher Ronald Crane reported an underflow found through
code inspection. This does not all have a clear mechanism to be
exploited through web content but could be vulnerable if a means can be
found to trigger it.

• CVE-2015-7213 (integer overflow allocating extremely large textures):

Security researcher Abhishek Arya (Inferno) of the Google Chrome
Security Team used the Address Sanitizer tool to discover an integer
overflow when when allocating textures of extremely larges sizes during
graphics operations. This results in a potentially exploitable crash
when triggered.

• CVE-2015-7214 (miscellaneous memory safety hazards):

Mozilla developers and community identified and fixed several memory
safety bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these bugs showed evidence of memory
corruption under certain circumstances, and we presume that with enough
effort at least some of these could be exploited to run arbitrary code.
Andrei Vaida, Jesse Ruderman, and Bob Clary reported memory safety
problems and crashes that affect Firefox ESR 38.4 and Firefox 42.