- add patch from fedora to explicitly disable building bundled libraries - add patches from szukw000 to fix CVE-2016-957[23] and CVE-2016-958[01]