Fixes all CVEs as well as a few more.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

- bump version to 4.0.9
- add patches copied from Debian for CVE-2017-18013 and CVE-2017-9935

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

The libtiff library declares an `ftell()` compat macro redirecting calls
to `ftello()` if such an implementation exists. The compat macro however
is declared with a wrong number of arguments, leading to the following
error on our buildbots:

    In file included from .../usr/include/uClibc++/iostream:29:0,
                     from tif_stream.cxx:31:
    .../usr/include/uClibc++/fstream:422:22: error: macro "ftell" requires 3 arguments, but only 1 given
         retval = ftell(fp);

Add a patch to fix the macro definition in order to fix compilation of
the tiff package.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>