Index: security/libressl/Makefile =================================================================== --- security/libressl/Makefile +++ security/libressl/Makefile @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= libressl -PORTVERSION= 2.2.3 +PORTVERSION= 2.2.4 CATEGORIES= security devel MASTER_SITES= OPENBSD/LibreSSL @@ -14,7 +14,12 @@ CPE_VENDOR= openbsd -CONFLICTS?= openssl-[0-9]* +OPTIONS_DEFINE= MAN3 +OPTIONS_DEFAULT= MAN3 +MAN3_DESC= Install API manpages (section 3) + +CONFLICTS?= openssl-[0-9]* \ + libressl-devel-[0-9]* GNU_CONFIGURE= yes CONFIGURE_ARGS= --enable-silent-rules @@ -32,4 +37,8 @@ regression-test: build cd ${WRKSRC} && ${MAKE} check +post-install-MAN3-off: + ${RM} -rf ${STAGEDIR}/${PREFIX}/man/man3 + ${REINPLACE_CMD} -e '/^man\/man3/d' ${TMPPLIST} + .include Index: security/libressl/distinfo =================================================================== --- security/libressl/distinfo +++ security/libressl/distinfo @@ -1,2 +1,2 @@ -SHA256 (libressl-2.2.3.tar.gz) = a1ccc21adf91d60e99246031b99c930c9af5e1b1b5a61b1bec87beef6f16d882 -SIZE (libressl-2.2.3.tar.gz) = 2967547 +SHA256 (libressl-2.2.4.tar.gz) = 6b409859be8654afc3862549494e097017e64c8d167f12584383586306ef9a7e +SIZE (libressl-2.2.4.tar.gz) = 2966157 Index: security/libressl/pkg-plist =================================================================== --- security/libressl/pkg-plist +++ security/libressl/pkg-plist @@ -38,7 +38,6 @@ include/openssl/lhash.h include/openssl/md4.h include/openssl/md5.h -include/openssl/mdc2.h include/openssl/modes.h include/openssl/obj_mac.h include/openssl/objects.h Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml +++ security/vuxml/vuln.xml @@ -58,6 +58,36 @@ --> + + LibreSSL -- Memory leak and buffer overflow + + + libressl + 2.2.3 + + + + +

Qualys reports:

+
During the code review of OpenSMTPD a memory leak and buffer overflow + (an off-by-one, usually stack-based) were discovered in LibreSSL's + OBJ_obj2txt() function. This function is called automatically during + a TLS handshake (both client-side, unless an anonymous mode is used, + and server-side, if client authentication is requested).
+ + + + http://marc.info/?l=openbsd-announce&m=144495690528446 + CVE-2015-5333 + CVE-2015-5334 + + + 2015-10-15/discovery> + 2015-10-16 + + + mbedTLS/PolarSSL -- DoS and possible remote code execution