json-c: update to 0.12, fixing CVE-2013-{6370,6371}
pam: upstream patch to fix CVE-2014-2583