Correct a pair of buffer overflows in the telnet(1) command:

Correct a pair of buffer overflows in the telnet(1) command:

CAN-2005-0468) A heap buffer overflow in env_opt_add() and related
functions.

(CAN-2005-0469) A global uninitialized data section buffer overflow in
slc_add_reply() and related functions.

As a result of these vulnerabilities, it may be possible for a malicious
telnet server or active network attacker to cause telnet(1) to execute
arbitrary code with the privileges of the user running it.

These fixes are based in part on patches
Submitted by:   Solar Designer <solar@openwall.com>
With calibration with the FreeBSD security officer: Jacques Vidrine <nectar@freebsd.org>