Merge branch 'staging'

It contains security updates.  I somehow forgot to push this yesterday.

pkgs/development/libraries/libtasn1/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl, texinfo }:
 
 stdenv.mkDerivation rec {
-  name = "libtasn1-4.9";
+  name = "libtasn1-4.10";
 
   src = fetchurl {
     url = "mirror://gnu/libtasn1/${name}.tar.gz";
-    sha256 = "0869cp6jx7cajgv6cnddsh3vc7bimmdkdjn80y1jpb4iss7plvsg";
+    sha256 = "681a4d9a0d259f2125713f2e5766c5809f151b3a1392fd91390f780b4b8f5a02";
   };
 
   outputs = [ "out" "dev" "devdoc" ];

pkgs/development/libraries/libtiff/default.nix

@@ -11,6 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "06ghqhr4db1ssq0acyyz49gr8k41gzw6pqb6mbn5r7jqp77s4hwz";
   };
 
+  prePatch =let
+      # https://lwn.net/Vulnerabilities/711777/
+      debian = fetchurl {
+        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-5.debian.tar.xz;
+        sha256 = "1ribxdn89wx3nllcyh7ql3dx6wpr1h7z3waglz1w7dklxm43q67l";
+      };
+    in ''
+      tar xf '${debian}'
+      patches="$patches $(cat debian/patches/series | sed 's|^|debian/patches/|')"
+    '';
+
   outputs = [ "bin" "dev" "out" "doc" ];
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/libraries/webkitgtk/2.14.nix

@@ -12,7 +12,7 @@ assert enableGeoLocation -> geoclue2 != null;
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "webkitgtk-${version}";
-  version = "2.14.2";
+  version = "2.14.3";
 
   meta = {
     description = "Web content rendering engine, GTK+ port";
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://webkitgtk.org/releases/${name}.tar.xz";
-    sha256 = "0mjmcxhafh6l6j062z2nwfqbbvfyx16iqrzrbajswijh23awpnrf";
+    sha256 = "0v0hkvggxi38cdb3v672qwr0m0y3x2rmnwh8j3q28869li8d9shb";
   };
 
   # see if we can clean this up....