Fix sendmail improper close-on-exec flag handling (CVE-2014-3956)
From FreeBSD SA-14:11

ok millert@
MFC ChangeCipherSpec fixes (CVE-2014-0224 and additional safeguard), ok jsing@

"Be selective as to when ChangeCipherSpec messages will be accepted.
Without this an early ChangeCipherSpec message would result in session
keys being generated, along with the Finished hash for the handshake,
using an empty master secret." From s3_clnt.c r1.64, s3_pkt.c r1.42,
s3_srvr.c r1.59, ssl3.h r1.19 - note that the ssl3.h change has been
applied to s3_locl.h instead to simplify patching.

"Ensure that we do not process a ChangeCipherSpec with an empty master
secret. This is an additional safeguard against early ChangeCipherSpec
handling."  From s3_pkt.c:1.43
MFC sess_cert fix (CVE-2014-3470)

"Ensure that sess_cert is not NULL before trying to use it.
Fixes CVE-2014-3470, from OpenSSL." From s3_clnt.c r1.66
MFC DTLS "Hello Request" fix (CVE-2014-0221)

"Do not recurse when a 'Hello Request' message is received while getting
DTLS fragments. A stream of 'Hello Request' messages will result in
infinite recursion, eventually crashing the DTLS client or server.
Fixes CVE-2014-0221, from OpenSSL.  Reported to OpenSSL by Imre Rad."
From d1_both.c r1.20
MFC DTLS buffer overflow fix (CVE-2014-0195)

"Avoid a buffer overflow that can be triggered by sending specially crafted
DTLS fragments. Fix for CVE-2014-0195, from OpenSSL. Reported to OpenSSL
by Juri Aedla." From d1_both.c r1.19