- Update to 4.3.24
- Don't attempt to remove directories owned by a dependency
- Update to patch level 25 (4.3.25)
- Provide CPE information [1]

Provided by:    des
Notified by:	Chet Ramey <chet.ramey@case.edu>
Fix CVE-2014-3659. The original fix in 25 was not enough.

Obtained from:	http://seclists.org/oss-sec/2014/q3/690 (bash developer)
Security:	CVE-2014-3659
Disable function importing from the environment by default.  This can be
enabled by using --import-functions or enabling the IMPORTFUNCTIONS option.

This removes the risk of further parser bugs leading to code execution, as
well as the risk to setuid scripts and poorly written applications that
do not cleanse their environment [1][2].

Also note that there is an unofficial 4.3.26 floating around that has not yet
been officially released.  r369261 covers the change in 4.3.26.

See also:
  http://seclists.org/oss-sec/2014/q3/747 [1]
  http://seclists.org/oss-sec/2014/q3/746 [2]
  http://seclists.org/oss-sec/2014/q3/755 [3]

Obtained from:	NetBSD (based on) [3]
PR:		193932
Reviewed by:	Eric Vangyzen
With hat:	portmgr

Conflicts:
	UPDATING
Update to patchlevel 26. This is a NOP as r369261 already covered it.
- Update to patchlevel 27 which changes how functions are exported.
  This should eliminate the recent vulnerabilities, but keep the
  requirement for --import-functions/IMPORTFUNCTIONS option for now.
- Loosen the --import-functions requirement so it is not needed when running
  an interactive shell. It is already disallowed for privileged/setuid mode.
- Show an error on stderr when an imported function is ignored.
Add RedHat's patch for CVE-2014-7186, commonly known as "redir_stack" overflow,
which has not been shown to be as critical as "shellshock" currently.

Security:	CVE-2014-7186
- Update to patchlevel 28 which fixes issues that were mostly addressed
  already in r369684.
- Update to patchlevel 4.3.29.

  This addresses the local crash from CVE-2014-6277. Note that
  the fixes applied in 4.3.25_2 (and upstream 4.3.27) already made
  this non-exploitable remotely.

  This makes 'bashcheck' [1] fully green now. It had a soft warning
  before for CVE-2014-6277.

[1] https://github.com/hannob/bashcheck
Update to 4.3.30
Simplify a bit plist by using new syntax
Update to 1.8.8.

Security update.

MFH:		2014Q3
make plist compatible with pkg-1.2.7_4