curl: minor update 7.35.0 -> 7.36.0, including CVE fixes
harfbuzz: minor update 0.9.27 -> .28
dbus: minor update 1.8.0 -> .2
rsync: fix CVE-2014-2855 by upstream patch