diff --git a/pkgs/applications/networking/instant-messengers/mcabber/default.nix b/pkgs/applications/networking/instant-messengers/mcabber/default.nix
index 3ae3f7bb3dd..ca752ccf826 100644
--- a/pkgs/applications/networking/instant-messengers/mcabber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/mcabber/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "mcabber-${version}";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchurl {
     url = "http://mcabber.com/files/mcabber-${version}.tar.bz2";
-    sha256 = "16hkb7v1sqp1gqj94darwwrv23alqaiqdhqjq8gjd6f3l05bprj4";
+    sha256 = "02nfn5r7cjpnacym95l6bvczii232v3x2gi79gfa9syc7w0brdk3";
   };
 
   buildInputs = [ openssl ncurses pkgconfig glib loudmouth libotr gpgme ];
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   configureFlags = "--with-openssl=${openssl.dev} --enable-modules --enable-otr";
 
   doCheck = true;
-  
+
   meta = with stdenv.lib; {
     homepage = http://mcabber.com/;
     description = "Small Jabber console client";
diff --git a/pkgs/development/interpreters/mujs/default.nix b/pkgs/development/interpreters/mujs/default.nix
index b8359488725..0a87d037454 100644
--- a/pkgs/development/interpreters/mujs/default.nix
+++ b/pkgs/development/interpreters/mujs/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchgit, clang }:
 
 stdenv.mkDerivation rec {
-  name = "mujs-2016-09-21";
+  name = "mujs-2016-11-30";
 
   src = fetchgit {
     url = git://git.ghostscript.com/mujs.git;
-    rev  = "5c337af4b3df80cf967e4f9f6a21522de84b392a";
-    sha256 = "1x5g6nycggc83md2dbr2nahjbkkmmn64bg25a8hih7z72sw41dgw";
+    rev  = "a0ceaf5050faf419401fe1b83acfa950ec8a8a89";
+    sha256 = "13abghhqrivaip4h0fav80i8hid220dj0ddc1xnhn6w9rbnrriyg";
   };
 
   buildInputs = [ clang ];
diff --git a/pkgs/development/libraries/boehm-gc/default.nix b/pkgs/development/libraries/boehm-gc/default.nix
index b0eec4e130b..fb1f177d969 100644
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, enableLargeConfig ? false }:
 
 stdenv.mkDerivation rec {
-  name = "boehm-gc-7.2f";
+  name = "boehm-gc-7.2g";
 
   src = fetchurl {
-    url = http://www.hboehm.info/gc/gc_source/gc-7.2f.tar.gz;
-    sha256 = "119x7p1cqw40mpwj80xfq879l9m1dkc7vbc1f3bz3kvkf8bf6p16";
+    url = http://www.hboehm.info/gc/gc_source/gc-7.2g.tar.gz;
+    sha256 = "0bvw6cc555qg5b7dgcqy3ryiw0wir79dqy0glff3hjmyy7i2jkjq";
   };
   patches = if stdenv.isCygwin then [ ./cygwin.patch ] else null;
 
diff --git a/pkgs/development/perl-modules/DBD-mysql/default.nix b/pkgs/development/perl-modules/DBD-mysql/default.nix
index 14ed14e34af..0e1db7e234d 100644
--- a/pkgs/development/perl-modules/DBD-mysql/default.nix
+++ b/pkgs/development/perl-modules/DBD-mysql/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, buildPerlPackage, DBI, mysql }:
 
 buildPerlPackage rec {
-  name = "DBD-mysql-4.033";
+  name = "DBD-mysql-4.039";
 
   src = fetchurl {
     url = "mirror://cpan/authors/id/C/CA/CAPTTOFU/${name}.tar.gz";
-    sha256 = "0769xakykps0cx368g4vaips4w3bjk383rianiavq7sq6g6bp66c";
+    sha256 = "0k4p3bjdbmxm2amb0qiiwmn8v83zrjkz5qp84xdjrg8k5v9aj0hn";
   };
 
   buildInputs = [ mysql.lib ] ;
diff --git a/pkgs/development/perl-modules/maatkit/default.nix b/pkgs/development/perl-modules/maatkit/default.nix
index e301bd1009f..fabb3824129 100644
--- a/pkgs/development/perl-modules/maatkit/default.nix
+++ b/pkgs/development/perl-modules/maatkit/default.nix
@@ -4,7 +4,7 @@ buildPerlPackage rec {
   name = "maatkit-7540";
 
   src = fetchurl {
-    url = "http://maatkit.googlecode.com/files/${name}.tar.gz" ;
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/maatkit/${name}.tar.gz";
     sha256 = "1a7rxrddkrsfxb2wj01ha91ld0vapfkqcy8j9p08l76zz2l8p2v1";
   };
 
diff --git a/pkgs/servers/http/tomcat/default.nix b/pkgs/servers/http/tomcat/default.nix
index 00aaff899dc..edf1e59931e 100644
--- a/pkgs/servers/http/tomcat/default.nix
+++ b/pkgs/servers/http/tomcat/default.nix
@@ -33,32 +33,32 @@ in {
 
   tomcat6 = common {
     versionMajor = "6";
-    versionMinor = "0.45";
-    sha256 = "0ba8h86padpk23xmscp7sg70g0v8ji2jbwwriz59hxqy5zhd76wg";
+    versionMinor = "0.48";
+    sha256 = "1w4jf28g8p25fmijixw6b02iqlagy2rvr57y3n90hvz341kb0bbc";
   };
 
   tomcat7 = common {
     versionMajor = "7";
-    versionMinor = "0.72";
-    sha256 = "1nx5pmz3bq3n20fdspqh8ljqy1nj67rwi1vsqjpkrvd996x7p73p";
+    versionMinor = "0.73";
+    sha256 = "11gaiy56q7pik06sdypr80sl3g6k41s171wqqwlhxffmsxm4v08f";
   };
 
   tomcat8 = common {
     versionMajor = "8";
-    versionMinor = "0.37";
-    sha256 = "0f9d4yxjzwdrayj5l3jyiclnmpb5lffvmsnp54qpf6m3gm7cj5i6";
+    versionMinor = "0.39";
+    sha256 = "16hyypdawby66qa8y66sfprcf78wjy319a0gsi4jgfqfywcsm4s0";
   };
 
   tomcat85 = common {
     versionMajor = "8";
-    versionMinor = "5.5";
-    sha256 = "0idfxjrw5q45f531gyjnv6xjkbj9nhy2v1w4z7558z96230a0fqj";
+    versionMinor = "5.8";
+    sha256 = "1rfws897m09pbnb1jc4684didpklfhqp86szv2jcqzdx0hlfxxs0";
   };
 
   tomcatUnstable = common {
     versionMajor = "9";
-    versionMinor = "0.0.M10";
-    sha256 = "0p3pqwz9zjvr9w73divsyaa53mbazf0icxfs06wvgxsvkbgj5gq9";
+    versionMinor = "0.0.M13";
+    sha256 = "0im3w4iqpar7x50vg7c9zkxyqf9x53xs5jvcq79xqgrmcqb9lk91";
   };
 
 }
diff --git a/pkgs/servers/rpcbind/default.nix b/pkgs/servers/rpcbind/default.nix
index ba2e1447ffe..744763c43f1 100644
--- a/pkgs/servers/rpcbind/default.nix
+++ b/pkgs/servers/rpcbind/default.nix
@@ -1,10 +1,10 @@
-{ fetchurl, stdenv, pkgconfig, libtirpc
+{ fetchurl, fetchpatch, stdenv, pkgconfig, libtirpc
 , useSystemd ? true, systemd }:
 
 let version = "0.2.3";
 in stdenv.mkDerivation rec {
   name = "rpcbind-${version}";
-  
+
   src = fetchurl {
     url = "mirror://sourceforge/rpcbind/${version}/${name}.tar.bz2";
     sha256 = "0yyjzv4161rqxrgjcijkrawnk55rb96ha0pav48s03l2klx855wq";
@@ -13,6 +13,10 @@ in stdenv.mkDerivation rec {
   patches = [
     ./sunrpc.patch
     ./0001-handle_reply-Don-t-use-the-xp_auth-pointer-directly.patch
+    (fetchpatch {
+      url = "https://sources.debian.net/data/main/r/rpcbind/0.2.3-0.5/debian/patches/CVE-2015-7236.patch";
+      sha256 = "1wsv5j8f5djzxr11n4027x107cam1avmx9w34g6l5d9s61j763wq";
+    })
   ];
 
   buildInputs = [ libtirpc ]