4 Late-Breaking News and Corrections

A bug in OpenSSL that could cause it to parse past the end of the message was found at the late stage of 7.4-RELEASE release process. The 7.4-RELEASE includes a fix for this issue by importing relevant parts from the OpenSSL CVS. This could be triggered by an incorrectly formatted ClientHello SSL/TLS handshake messages. The details can be found at http://www.openssl.org/news/secadv_20110208.txt.

The shared object version numbers of libcrypto and libssl have been decreased from 6 to 5. These are accidentaly increased on 28 November, 2010 (r215997) as OpenSSL 0.9.8p was merged. Note that this affects systems running 7-STABLE after that date (after 7.3-RELEASE), not 7.3-RELEASE and the security branch. Also note that in FreeBSD 7.4-RELEASE, the library files with the version number 6 are still provided as symbolic links to prevent binaries built in the time window with the accidentaly increased version number from being broken after the system gets updated to 7.4-RELEASE.