Due to a merge issue, the openssl-1.0.1h package in SmartOS 13.2.* images (i.e. pkgsrc-2013Q2) is vulnerable to heartbleed. We are in the process of rebuilding the package with a fix, and when it is ready it will be available as openssl-1.0.1hnb1.
In the meantime you can install the openssl-1.0.1h package from 2013Q3 as it is compatible with your installed packages and is not vulnerable.
$ env PKG_PATH=$(awk -F= '{ gsub("Q2", "Q3"); print $2 }' \
/opt/local/etc/pkg_install.conf) pkg_add -U openssl-1.0.1h