diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index e5e8cacd21cd..ad1091c9d39e 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, config
 
 ## various stuff that can be plugged in
-, gnash, flashplayer, hal-flash
+, flashplayer, hal-flash
 , MPlayerPlugin, ffmpeg, gst_all, xorg, libpulseaudio, libcanberra_gtk2
 , supportsJDK, jrePlugin, icedtea_web
 , trezor-bridge, bluejeans, djview4, adobe-reader
@@ -23,16 +23,13 @@ browser:
 let
   cfg = stdenv.lib.attrByPath [ browserName ] {} config;
   enableAdobeFlash = cfg.enableAdobeFlash or false;
-  enableGnash = cfg.enableGnash or false;
   ffmpegSupport = browser.ffmpegSupport or false;
   jre = cfg.jre or false;
   icedtea = cfg.icedtea or false;
 
   plugins =
-     assert !(enableGnash && enableAdobeFlash);
      assert !(jre && icedtea);
      ([ ]
-      ++ lib.optional enableGnash gnash
       ++ lib.optional enableAdobeFlash flashplayer
       ++ lib.optional (cfg.enableDjvu or false) (djview4)
       ++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser)
diff --git a/pkgs/development/libraries/jbig2dec/default.nix b/pkgs/development/libraries/jbig2dec/default.nix
index 123379d788dc..45df4876be1f 100644
--- a/pkgs/development/libraries/jbig2dec/default.nix
+++ b/pkgs/development/libraries/jbig2dec/default.nix
@@ -1,15 +1,23 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  name = "jbig2dec-0.11";
+  name = "jbig2dec-0.13";
 
   src = fetchurl {
-    url = "mirror://sourceforge/jbig2dec/${name}.tar.xz";
-    sha256 = "1xddc30garsg5j8p348cz5l8vn8j7723c0sykv0kc1w5ihaghsq1";
+    url = "http://downloads.ghostscript.com/public/jbig2dec/${name}.tar.gz";
+    sha256 = "04akiwab8iy5iy34razcvh9mcja9wy737civ3sbjxk4j143s1b2s";
   };
 
+  patches =
+    [ (fetchpatch {
+        url = "http://git.ghostscript.com/?p=jbig2dec.git;a=patch;h=e698d5c11d27212aa1098bc5b1673a3378563092";
+        sha256 = "1fc8xm1z98xj2zkcl0zj7dpjjsbz3vn61b59jnkhcyzy3iiczv7f";
+        name = "CVE-2016-9601.patch";
+      })
+    ];
+
   meta = {
-    homepage = http://jbig2dec.sourceforge.net/;
+    homepage = https://www.ghostscript.com/jbig2dec.html;
     description = "Decoder implementation of the JBIG2 image compression format";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.unix;