Update to 3.17.2

Changelog:
New in NSS 3.17.2

New Functionality

No new functionality is introduced in this release. This is a patch release to fix a regression and other bugs.

Notable Changes in NSS 3.17.2

    Bug 1049435: Change RSA_PrivateKeyCheck to not require p > q. This fixes a regression introduced in NSS 3.16.2 that prevented NSS from importing some RSA private keys (such as in PKCS #12 files) generated by other crypto libraries.
    Bug 1057161: Check that an imported elliptic curve public key is valid. Previously NSS would only validate the peer's public key before performing ECDH key agreement. Now EC public keys are validated at import time.
    Bug 1078669: certutil crashes when an argument is passed to the --certVersion option.

Bugs fixed in NSS 3.17.2

This Bugzilla query returns all the bugs fixed in NSS 3.17.2:

https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&classification=Components&query_format=advanced&product=NSS&target_milestone=3.17.2

Compatibility

NSS 3.17.2 shared libraries are backward compatible with all older NSS 3.x shared libraries. A program linked with older NSS 3.x shared libraries will work with NSS 3.17.2 shared libraries without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs to the functions listed in NSS Public Functions will remain compatible with future versions of the NSS shared libraries.
Updated devel/nss to 3.17.2
Update to 33.0

Changelog:
New
OpenH264 support (sandboxed)

New
Improved search experience through the location bar

New
Slimmer and faster JavaScript strings

New
Search suggestions on the Firefox Start (about:home) and new tab (about:newtab) pages

New
Windows: OMTC enabled by default

New
New CSP (Content Security Policy) backend

New
Support for connecting to HTTP proxy over HTTPS

New
Improved reliability of the session restoration

New
Azerbaijani [az] locale added

Changed
Proprietary window.crypto properties/functions removed

Changed
JSD (JavaScript Debugger Service) removed in favor of the Debugger interface

HTML5
@counter-style rule from CSS3 Counter Styles specification implemented

HTML5
DOMMatrix interface implemented

Developer
Cubic-bezier curves editor

Developer
Display which elements have listeners attached

Developer
New sidebar which displays a list of shortcuts to every @media rule in the current stylesheet

Developer
Paint flashing for browser content repaints

Developer
Editable @keyframes rules in the Rules section of the Inspector

Developer
CSS transform highlighter in the style-inspector

Fixed
Fix incomplete downloads being marked as complete by detecting broken HTTP1.1 transfers (237623)

Fixed
Various security fixes

Fixed in Firefox 33
MFSA 2014-82 Accessing cross-origin objects via the Alarms API
MFSA 2014-81 Inconsistent video sharing within iframe
MFSA 2014-80 Key pinning bypasses
MFSA 2014-79 Use-after-free interacting with text directionality
MFSA 2014-78 Further uninitialized memory use during GIF
MFSA 2014-77 Out-of-bounds write with WebM video
MFSA 2014-76 Web Audio memory corruption issues with custom waveforms
MFSA 2014-75 Buffer overflow during CSS manipulation
MFSA 2014-74 Miscellaneous memory safety hazards (rv:33.0 / rv:31.2)
Updated www/firefox to 33.0
Update to 33.0

* Sync with firefox-33.0.
Updated www/firefox-l10n to 33.0
Add missing patches.
Remove unused pacthes.
Thank you, Richard PALO.
.tar.bz seems now broken, changed (MASTER_SITED and) to .tar.bz2. Thanks joerg@
Update to openssl-1.0.1j.

 Changes between 1.0.1i and 1.0.1j [15 Oct 2014]

  *) SRTP Memory Leak.

     A flaw in the DTLS SRTP extension parsing code allows an attacker, who
     sends a carefully crafted handshake message, to cause OpenSSL to fail
     to free up to 64k of memory causing a memory leak. This could be
     exploited in a Denial Of Service attack. This issue affects OpenSSL
     1.0.1 server implementations for both SSL/TLS and DTLS regardless of
     whether SRTP is used or configured. Implementations of OpenSSL that
     have been compiled with OPENSSL_NO_SRTP defined are not affected.

     The fix was developed by the OpenSSL team.
     (CVE-2014-3513)
     [OpenSSL team]

  *) Session Ticket Memory Leak.

     When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
     integrity of that ticket is first verified. In the event of a session
     ticket integrity check failing, OpenSSL will fail to free memory
     causing a memory leak. By sending a large number of invalid session
     tickets an attacker could exploit this issue in a Denial Of Service
     attack.
     (CVE-2014-3567)
     [Steve Henson]

  *) Build option no-ssl3 is incomplete.

     When OpenSSL is configured with "no-ssl3" as a build option, servers
     could accept and complete a SSL 3.0 handshake, and clients could be
     configured to send them.
     (CVE-2014-3568)
     [Akamai and the OpenSSL team]

  *) Add support for TLS_FALLBACK_SCSV.
     Client applications doing fallback retries should call
     SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
     (CVE-2014-3566)
     [Adam Langley, Bodo Moeller]

  *) Add additional DigestInfo checks.

     Reencode DigestInto in DER and check against the original when
     verifying RSA signature: this will reject any improperly encoded
     DigestInfo structures.

     Note: this is a precautionary measure and no attacks are currently known.

     [Steve Henson]
Updated security/openssl to 1.0.1j
Add back manual page which somehow was removed yet got past install checks.
Fix wip reference.
Sync PLIST with installation. Bump revision.
Racy build.
Fix clang build again for amd64.
Remove unused strnstr prototype.
Fix strnstr support properly.
Bump revision for strnstr fix.
Don't use ftime.